@ericwoodland uploaded a file: Pasted image at 2016-07-22, 3:57 PM
@jaimin.s uploaded a file: Spotted cow and commented: Cooling in the fridge
@macbentosh uploaded a file: fullsizeoutput_3a3.jpeg
To answer your question from yesterday @macbentosh -
@macbentosh uploaded a file: Screen Shot 2017-05-19 at 3.33.17 PM.png
@Woody uploaded a file: Pasted image at 2017-10-04, 11:50 AM
@macbentosh uploaded a file: Screen Shot 2017-10-05 at 12.59.26 PM.png
In case you’re using Azure AD and looking to integrate with MobileIron Cloud - https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-mobileiron-tutorial
*Thread Reply:* Let’s try using a thread for the responses 🙂
*Thread Reply:* Single Core, HA, Multiple Cores for different purposes @macbentosh?
*Thread Reply:* On-prem & Cloud, single cores though have done a few HA + cold DR too
*Thread Reply:* @macbentosh are you running Email/Tunnel on all 5 Sentrys?
*Thread Reply:* Curious how many folks combine services these days
*Thread Reply:* 1 non kerb sentry 2 kerb email and 2 app sentry
*Thread Reply:* 2 Cores, 10 Sentry appliances globally
*Thread Reply:* @macbentosh why the need for the non-KCD Sentry? Folks that haven’t yet migrated, accessing EAS manually, etc?
*Thread Reply:* we had an issue with shared devices and the kerb serts
*Thread Reply:* we also use it for additional accounts. assistants who want their email and their boss
*Thread Reply:* Kerb doesnt work for additional accounts
*Thread Reply:* OnPrem, CLOUD (we are a MI partner so we have both)
*Thread Reply:* Same as Ole, both Cloud, CORE + Connected Cloud, Hosted CORE for our customers
On Prem
}
*Thread Reply:* Dependa what section/area you're looking at and from what angle... to work for, or as a customer?
*Thread Reply:* MobileIron hosted server count in the German DC I mean.. :)
*Thread Reply:* From a platform technology perspective it's a stable and up to date offering at the core. Biggest issues through are around deployments of the UEM componants and managing non ios or Android devices. The "offering" as a product just hasn't been looked after properly.
*Thread Reply:* It would be great if the activation service for Email+ would also be shown on that site - it was down a couple if weeks ago and this would help!
*Thread Reply:* We are troubleshooting an issue with random long HA sync times, like 14-24 hours for Cores with at most 30k devices. We switched NIC on VMs recently as a recommendation by MI, no luck. We are going to test flipping primary to other data enter now in QA to see if that makes a difference. There are a lot of factors here and we are trying to rule out 1 by 1
*Thread Reply:* For more background. (2) environments, both with (2) Cores, (1) in seawater data centers with HA sync set to every 2 hours between the Primary/Secondary. Nightly auto backup runs once every 24 hours as our fallback. Compliance check interval set to run every 12 hours for reference. We also have (3) Assemble jobs that run daily.
*Thread Reply:* Long sync intervals are very sporadic, happening a few times within a week span with no specific times
*Thread Reply:* How annoying. Intermittent issues are always the hardest to track down.
*Thread Reply:* Which version(s) of Core servers?
*Thread Reply:* (And has this been an ongoing problem, or a recent one?)
*Thread Reply:* Currently at 9.4 in Prod and testing 9.5 in QA. Still seeing the issue in QA relative to device count obviously. Normal sync times in QA are about 2 minutes, long ones shoot up to 20, for like 10 devices
*Thread Reply:* We aren’t sure how long honestly. We noticed recently after reviewing logs and sync times just because we wanted an idea
*Thread Reply:* The QA servers in the same DC locations, presumably?
*Thread Reply:* @thebjohn that is odd. We had 2 Cores with nearly 60k devices syncing in ~1 hour and 45 mins.
*Thread Reply:* That is our average time, then have the long ones popping in at random
*Thread Reply:* And the QA servers running on different VM servers, presumably?
*Thread Reply:* I think that your approach is the intelligent one, reducing the factors that could be causing the issue in order to identify the real culprit.
*Thread Reply:* I would be tempted to run the two QA Cores in the same DC, to rule out the wet-string and as many intermediary switches/routers from the equation as possible.
*Thread Reply:* Are you seeing occasional timeouts with your API calls too?
*Thread Reply:* Yes, different VMs but essentially mimic prod so that we can test configurations, upgrades, etc prior to rollout in Prod
*Thread Reply:* With APIs not that I know of
*Thread Reply:* I don’t think we could get ESX hosting to switch the VM to a data center easily as that would require re IPing and all that fun stuff
*Thread Reply:* Specifically different VM physical host servers?
*Thread Reply:* Oh, we have some using vMotion for that, but that’s another story.
*Thread Reply:* The challenge is going to be to consistently replicate the failures in the QA servers - absence of a failure won’t prove absence of a potential issue.
*Thread Reply:* I guess the answer to your question is: no, that shouldn’t happen. Unfortunately, I guess what you really want is the answer to “why does this happen?” and even more so “how do I stop it from happening?” 🙂
*Thread Reply:* Haha, well, that is ideal, but I know this one is going to be tough to crack. We are trying to review network issues, VM hosting and Mobile Iron simultaneously. As you know with any IT organization, they don’t like to be called out for issues, so finger pointing starts
*Thread Reply:* Understood. May I ask that you leave this with me - you’ve piqued my interest on this and I’d like to discuss it with our technical team just to make sure none of us have seen this before and I’m missing something obvious.
*Thread Reply:* We have a case open with MI, and have for a few weeks but seems to be no end in sight, which is why we are starting to try a few things to see what happens. Any suggestions you may have are greatly appreciated! @Jason
*Thread Reply:* @thebjohn has MobileIron identified any areas they perceive to be a pain Point?
*Thread Reply:* I’m curious if it’s taking more time to perform the DB export/zip or if it’s during the transfer process to the secondary, etc.
*Thread Reply:* Not yet. The NIC change on the ESX host was their only recommendation thus far
*Thread Reply:* I'd check what Jobs are running during synch to see if they can be interfering possibly
*Thread Reply:* We run the standard cleanups for housekeeping quarterly as well as prior to every Core upgrade.
*Thread Reply:* It’s hard to catch since we haven’t seen consistent times, to determine what other processes are running.
*Thread Reply:* Perhaps there is some existant debug logging functionality in the appsync script of secondary Core, which could be enabled. If not, I'ld suggest to integrate such logging manually. It is important to understand what takes long, to identify why it takes long.
*Thread Reply:* @thebjohn Quite a while back I have seen a similar issue and spent days searching round. The initial tests I would suggest on your dev environment if that has the issue, capture the port diagnostics and search the PCAP. Wireshark is what my guys used and came up with lots of DB error returns. We ended up as a test backing up the DB and restoring to fresh build of Core. This seemed to resolve in our case.
*Thread Reply:* Apologies if you have already done this.
*Thread Reply:* Infrastructure issues are always the most complex and each department always looks at the others.
*Thread Reply:* Like in ms teams, threading is not a default knee-jerk thing to do here. Could be better
*Thread Reply:* Agreed, but as this grows, so will the difficulty in finding questions/answers, so this makes sense.
*Thread Reply:* Yeah - Easier to search for a thread and find all associated comments/etc
*Thread Reply:* Only downside is you can’t drop attachments into threads
*Thread Reply:* Agree. I think we’ll see more revisions to it. We’re technically in 1st Gen threading, haha
*Thread Reply:* Where’s Usenet when you need it, eh?
*Thread Reply:* I don't know if current, but we've had Sentry in AWS.
*Thread Reply:* Standalone Sentry works, but currently only supported for MI Cloud afaik
*Thread Reply:* That’s accurate, @Fabian. Just completing my first in Azure. Fairly straightforward, though I believe AWS is even easier.
*Thread Reply:* i am still trying to install a cloud sentry in Azure with arm mode
*Thread Reply:* if anyone has reliable cli commands in arm mode, let me know 🙂
*Thread Reply:* No, I think it is also supported with Core
*Thread Reply:* @Ole Schulenburg AFAIK all it supports ATM is Classic. Haven’t seen much success on the latter
*Thread Reply:* well i know. i tried in our environment in asm mode and it worked. but this customer doesn't want to (or cant?) use asm and want to use arm
*Thread Reply:* anyway i have a set of commands, i will try them and elt you know
*Thread Reply:* @Ole Schulenburg a set of commands you say? Care to share? 🙂
*Thread Reply:* yes. if they work i will share them. i am getting around to test them this week. hopefully next tuesday
*Thread Reply:* Looks like they aren't growing fast enough for investers. Makes sense to put a money man at the top.
*Thread Reply:* Having met them both, I understand. Barry was friendly enough, but not the dynamic leader that MobileIron deserves. I think that Simon is the right person for the job - he will do a great job leading them in their next phase of growth, IMHO.
*Thread Reply:* @macbentosh Barry has left the business. Simon (previously CFO) has taken over.
*Thread Reply:* I believe the correct phrase is that “he was resigned”…
*Thread Reply:* Replaced a people person with a finance guy, my perspective is more focus on bottom line and shareholders vs customers. May be a stretch, but just a perspective
*Thread Reply:* Bottom line hasn’t been unhealthy, though you could argue that top line hasn’t grown quickly enough. Having met both, in this case I would say that Simon inherited the extrovert genes.
*Thread Reply:* @thebjohn MobileIron will never loose foucs on customers. The product and the company are build up on customers needs!
*Thread Reply:* I'd certainly like to come to the next one!
*Thread Reply:* So you have not be on the last one?
*Thread Reply:* None so far, I was at the TPS but haven't ventured over to Berlin as yet.
*Thread Reply:* You should. This is an experience you will never have somewhere else!
*Thread Reply:* I don't see why I couldn't having the dates this far ahead 😎
Thanks for the release folks, I've been waiting on this for ages 🙂 https://bayton.org/2017/10/mobileiron-officially-supports-android-enterprise-qr-code-provisioning/
*Thread Reply:* Why? Isn’t DEP enough for you or do you have another requirement in mind?
*Thread Reply:* Have you tried a QR code for the iReg process? You can generate one with the code and email it to the team, print it out, etc.
*Thread Reply:* https://<core_fqdn>/mifs/c/i/reg/reg.html
*Thread Reply:* What would be dope is for the QR to include WiFi creds for a provisioning SSID. Curious what the likelihood of that happening is
*Thread Reply:* @Jason I believe you can send that QR code in your provisioning email too unless I'm mixing my UEM and MI knowledge.
*Thread Reply:* Though, that said, I haven’t tried it myself in a while. (Just a tick)
*Thread Reply:* Yup, as I thought, it’s HMTL, so as long as you can host the image somewhere, you’re good to go.
*Thread Reply:* @Woody Not sure how you’d include the WiFi creds in a URL exactly, but open to being taught!
*Thread Reply:* @Jason IDK if it’s possible either, but that would be epic. QR, join the network, install the client, become managed and you’re on your way. Same would be great at the beginning of the DEP wizard
*Thread Reply:* You can share WIFI over QR, but it's inherently unsecure.
No worries @Kiran Patel, was a lot of fun to work on it 🙂
*Thread Reply:* @Jason Bayton How would you do that for iOS, please?
*Thread Reply:* Android/iOS can both read a QR containing WiFi info, but I think a hosted configuration file with a link in the QR is likely the easiest and most secure. I'll see if I can figure something out
*Thread Reply:* The thought would be to hop them on an isolated ‘Provisioning ’ WiFi segment just for enrolling to MDM, so even if someone deciphered the creds they would have minimal access
*Thread Reply:* Exactly. Onto a guest wifi, enrol through ireg, job done!
*Thread Reply:* guest wifi + ireg + ideally one time unique for users username and pin in the reg email would be great.
*Thread Reply:* Not sure if all of that is technically possible but that's the visition
*Thread Reply:* Interesting. I honestly don’t know that any of the protocols/values for this age-old setting would/should have changed with iOS 11.
*Thread Reply:* That was my thought too, maybe a Core bug?
*Thread Reply:* Any chance you’re part of the Preview Program? 9.6 (Atlanta) has a lot of iOS 11 improvements
*Thread Reply:* ETA still end of November release?
*Thread Reply:* I was also checking the general iOS 11 Compatibility page and saw no mention of something like this: https://community.mobileiron.com/docs/DOC-6671
*Thread Reply:* Ya, we are a little baffled on this. Reason I ask is we plan to align all of our programs to a 6-digit minimum, which is lowering Corp stuff from 8 to 6, but upping BYOD from 4 to 6. Need to confirm Core marks as non-Compliant if at 4, but doesn’t seem to be the case in testing in 9.5
*Thread Reply:* Do you have “policy out of date” compliance actions in place?
*Thread Reply:* This may be iOS 11 specific
*Thread Reply:* I tested on a 10.3.3 device with only a 4-digit PIN prior to registering. It then gave me continues prompts every 15 minutes when I selected later, but after 1 hour, forced me to change it, expected behavior. iOS 11 device just seems to allow just pressing later
*Thread Reply:* Confirming one more time on an 11.0.3 device that this is he case
*Thread Reply:* Do you have iOS 11.1 Beta 5-ish to try as well?
*Thread Reply:* Not yet. That’s another thing to try
*Thread Reply:* I have to test as is first with official releases since we block Betas for Corp and BYOD devices. By block, we have compliance actions, but I’m special and am excluded. Once the hour wait period is up on my 11 device I just re-enrolled, I’ll try a beta release and see
*Thread Reply:* I’ll report back on findings
*Thread Reply:* If an iOS 11-11.0.3 bug only, then hooray
*Thread Reply:* :( ok. The report doesn't go into enough detail for the customer.
*Thread Reply:* gotcha. I’d like to see this improved too
*Thread Reply:* Seemingly not, see Russ' reply above.
*Thread Reply:* Unfortunate - will be nice once they finally merge the code for the 2 products
*Thread Reply:* I haven't seen anything as yet? Does it look horrendous? 😄
*Thread Reply:* There‘s just a lot of black space, not nice if email+ is your daily mail client 😀
*Thread Reply:* http://d.pr/i/XVSQ3b/CJE078kk
*Thread Reply:* http://d.pr/i/87eArG/4XtpdA2i
*Thread Reply:* 😆 I guess it makes sense they hard-code the height? I mean it looks like they have done that at least.
*Thread Reply:* Last feedback from support: „There will only be a limited difference between iPhone 8 and iPhone X from the apps perspective“
*Thread Reply:* Well that's fine if the "limited difference" is filling the black bars..
MobileIron CORE. CLOUD supports it.
}
*Thread Reply:* Thanks. With a script running every x minutes, and then install it when connected to WiFi. Go and see assemble trigger name. Thanks again
*Thread Reply:* Much better to control access to the destination than to remove the app
*Thread Reply:* Use tunnel to a sentry on the local network for example
*Thread Reply:* don’t expose sentry to outside world- only accessible from that WIFI network
*Thread Reply:* The app got cache on it. So user can access to data so even in plane mode they can access :(
*Thread Reply:* Other options: AirPatrol (geo fencing) or Cisco ISE (if in use) integration
*Thread Reply:* Assemble and geofencing was yesterday a solution but I have to inventory all gps sites so I will look for air patrol. We have Cisco ise but what was your thoughts ? Thanks
*Thread Reply:* Not sure about the ISE capabilities with the MI API, but I would envision that ISE can add/remove labels whenever the device joins/leaves an ISE managed WiFi.
*Thread Reply:* Ah yes, I used to work with mi api and trusted deviced enrolled onto MI with a trigger that was MAC address. But it could be very difficult due to energy saving. I will force app dev to shutdown app if no ssid connected and a specific url with ok 200. to complicated and painful for end user
*Thread Reply:* probably the easiest solution if you have control over the app development 🙂
*Thread Reply:* @Tobias I will force to do that. Thanks again
*Thread Reply:* Mac controls, AE improvements, windows improvements, few other bits and pieces. Looks like a major Mac release actually.
*Thread Reply:* My favorite is the Work Schedule policy
*Thread Reply:* Oh yes, I forgot about that @Russell Mohr
@Woody uploaded a file: Pasted image at 2017-11-16, 11:49 AM
@Jason Bayton uploaded a file: 201711161806_00.gif
*Thread Reply:* Still wandering why some configurations are not policies and vice versa... iOS restrictions should be lockdown policies!!
@thebjohn uploaded a file: Slack for iOS Upload
*Thread Reply:* Define? I understand there's a fix in 9.6 for LDAP for the bug in 9.4-9.5
*Thread Reply:* not picking up all ad groups
*Thread Reply:* we do kerb email label with an ad security group
*Thread Reply:* What do the LDAP logs say in MICS @macbentosh?
*Thread Reply:* Any indication that it’s seeing the group, but with no changes? Or just not seeing the group at all?
*Thread Reply:* it’s in the group in ad but the label doesn’t apply
*Thread Reply:* and just to config the group is under the LDAP config in MI to sync right?
*Thread Reply:* So if you take the failing label syntax and plug it into a new label filter, does the device appear in the results?
*Thread Reply:* Is “Sync discard” option enabled?
*Thread Reply:* The suspense is killing us, @macbentosh LoL
*Thread Reply:* Odd @macbentosh. What do your LDAP Search Filters look like for Users? The default or something different?
*Thread Reply:* Default = (&(objectClass=user)(objectClass=person))
*Thread Reply:* When using LDAP (not LDAPS) make a trace and look at it in Wireshark. It gives you a clear view what Core is requesting and what the responses look like. That might give some insight what exactly is misbehaving
*Thread Reply:* and @macbentosh this was working in your former version of Core, yes? Any chance you ran 9.6 in a DEV/QA scenario before it went into PROD?
@macbentosh uploaded a file: Screen Shot 2017-11-21 at 2.14.35 PM.png
*Thread Reply:* Only in JIRA, no public info right now. Will be mentioned in the Release-Notes. If you need more details, pls ping me.
*Thread Reply:* Is there an ETA for the fix? Hoping it's in 9.6.0.1
*Thread Reply:* JIRA internal to MI or Partners too? I had a very brief look between flights last week but didn't see anything jump out.
*Thread Reply:* Ours is names that it is not expecting within {}
*Thread Reply:* Batch processing has been causing problems from 9.4 already.. with the fix supposed to be in 9.6
@Woody uploaded a file: Pasted image at 2017-11-27, 2:21 PM
*Thread Reply:* If Dirk is still around (I forget his surname but there's only one I'm aware of looking after hosted Cores) ask that he's involved with troubleshooting. VGE will have full access to the systems so should see something.
*Thread Reply:* Mueller? Nope, he’s not there anymore
*Thread Reply:* It seems that many (all?) API queries are causing stress on the Core, but there is one that certainly kills the system instantly; https://corename.vodafone.com/api/v2/authorized/users?adminDeviceSpaceId=1
*Thread Reply:* We asked VGE (Vodafone Global Enterprise) for that some months ago but where I was under the impression that it was simply spinning up another VM with based on the MI ReportingDB install guide, VGE told me it would require a 3 month project as it wasn't part of their standard services...
*Thread Reply:* I might otherwise just spin that up on-premises and open up the required network ports to make it work?
*Thread Reply:* One example is the API query https://corename.vodafone.com/api/v2/authorized/users?adminDeviceSpaceId=1 but we are basically trying to use all v2 APIs and also some v1 APIs. We are using a combination of JSON and CSV. I think most API queries are returning JSON. I am using Microsoft PowerBI as the tool, and so far I did not worry about offsets and limits as it seems that PowerBI manages to structure the data for me. But maybe that is part of the issue? But still, I can understand that the API queries cause a certain (high) load on the Core, and that it takes a certain time to process. But now it seems that processes on the Core just die (Tomcat?). Shouldn't that be protected from happening?
This is an example that VGE shared with me illustrating the API Core load
@Russell Mohr uploaded a file: Screen Shot 2017-12-06 at 3.28.39 PM.png
@Russell Mohr uploaded a file: Screen Shot 2017-12-06 at 3.38.26 PM.png
@thebjohn uploaded a file: Image uploaded from iOS
@Woody uploaded a file: CoreConnectorReleaseNotes9600_Rev30Nov2017.pdf
*Thread Reply:* Well, boo! Anywho, it’s being re-released in the China app store. For Core, ATM.
*Thread Reply:* https://itunes.apple.com/us/app/mobileiron-centaur/id1315143363?mt=8
*Thread Reply:* Was it pulled because it's a VPN client? What's the workaround that got it back on?
*Thread Reply:* Well, AFAIK it’s a front-end activator for the VPN configuration profile that MI delivers. It may house the config, but in all reality it’s the Apple built-in VPN framework doing the heavy lifting.
*Thread Reply:* “MobileIron Centaur supports the same list of features as MobileIron Tunnel.”
*Thread Reply:* The next one will be MobileIron Unicorn[TM], you’ll see… 😉
*Thread Reply:* And who doesn’t want a VPN secretly disguised as a Unicorn on their device? #Clever
*Thread Reply:* Centaur works the same as Tunnel but also pipes a copy of the unencrypted traffic to a Chinese gov server farm, which makes it compliant to the Chinese regulations.
But it's also possible that the app name just is not allowed to contain any references to Tunneling techniques.
*Thread Reply:* That's pretty horrendous (the regulations)
*Thread Reply:* Was just kidding (hopefully) 🙂
But more important to me is the question if this change will have an impact on device-based VPP distributed MI Tunnel when the VPP licenses were purchased in another Country. Would devices in China still be able to install MI Tunnel when they receive it as device-based VPP installation request?
*Thread Reply:* https://goo.gl/xOWk1m
*Thread Reply:* We JUST rolled out Tunnel for Safari and Remote Desktop client globally this past Thursday, this is a real kick to the dick considering we just rolled this out
*Thread Reply:* We have about 350 Corp devices in China we have to look into re-Engineering our solution for. I had 0 idea this wasn’t available as of July
*Thread Reply:* And strangely, we rolled out a Field Test for some BYOD changes for iOS. We have a user in China as part of this Field Test, and I see he has Tunnel installed. This Field Test was just rolled out last week...
*Thread Reply:* Well now you've lost plausible deniability when they come for you @thebjohn
*Thread Reply:* @thebjohn As I understand, devices which installed the app before the removal from China AppStore will keep it. But you cannot do new installations.
*Thread Reply:* Doesn’t seem to be entirely true, as we deployed Tunnel last week as part of a Field Test, and the 1 user we have in China as part of the Field Test has Tunnel installed 🤔
*Thread Reply:* Is device-based VPP in use? Maybe this circumvents the limitation somehow.
*Thread Reply:* Hmm, we are leveraging VPP for Corp only based on labels, not for BYOD
*Thread Reply:* Product Bulletin also states just Tunnel v2.2, I assumed this also applies to future releases, or it should? We see v2.3.1 in China on devices
*Thread Reply:* I just registered a test device and selected "China" during setup. Also added an Apple ID whichs Country was set to "China". Device-based VPP installation works for MI Tunnel 2.3.1. The Apple ID cannot find MobileIron Tunnel in the AppStore, only Centaur. I have no clue if this is a meaningful test result as the device is still physically located in Germany and the same device already was assigned with a VPP licensed MI Tunnel app before I wiped it.
*Thread Reply:* That sounds like a fair test @Tobias. It sounds like you’re being ushered-in to the China instance of the App Store based on the Country you selected (instead of being redirected based on Geo/Source IP)
*Thread Reply:* If that’s all it is though, just telling users to register as in another country is all it’d take to keep Tunnel running
*Thread Reply:* So even if you publish an app in Apps@Work using a bundle ID and select AppStore Country say United States, a person in China can still pull from the US AppStore even though Geo should route their device to the China AppStore?
*Thread Reply:* It sounds like China the Great would have taken that into consideration as part of their blocking…
*Thread Reply:* That’s my assumption. So for a global company, whether you publish in Apps@Work as US blanket across the board, devices should technically still pull from their Home Country Apple AppStore, that’s my assumption. But based on what we are seeing for Tunnel in China, something is funky here
*Thread Reply:* Regarding traditional app deployment through Apps@Work this should definitely hold true. The installation request contains just the App ID and the app is downloaded from whichever country app store the Apple ID is currently configured for. However, for device based VPP the same is unclear to me. Apple doc states "VPP apps can be assigned to devices or users in any country where the app is available, enabling multinational distribution for your enterprise". But how is the device-to-country mapping done?
*Thread Reply:* Btw, 德国 is chinese for Germany, if anyone ever needs to move back his Apple ID Country from China to Germany 😄
*Thread Reply:* @thomrburg can provide some insight regarding VPP here. I believe he said previously that an asset (app) is made available based on the countries selected by the developer. I’m not sure what specifically is used to determine -what- store the lookup/request is performed against.
*Thread Reply:* We have a user in China testing some scenarios for us. If it is in fact somehow reaching back to the US AppStore, then we have a problem. Moreso if it is doing it over cellular, which shouldn’t even work if it is communicating with the China public AppStore. I would also be very curious to see how other global companies are handling this, especially if they deploy their internal network in China, which has to route back out.
*Thread Reply:* Also, I don’t see any official documentation on the Centaur app other than what is published in the public App Store for the app. I would like to see some official doc on capabilities and differences between Tunnel, especially the part that was mentioned earlier about traffic being unencrypted and piped to Chinese govt servers, that would be a huge legality issue for us
*Thread Reply:* It was also a joke, but not far from reality I'd fear.. :p
*Thread Reply:* Although a joke, it wouldn’t surprise me. I’m finding it hard to believe the same app just published under a new name for China is all there is to it
*Thread Reply:* Got confirmation from our account manager after touching base with MI PMs, Centaur code is identical to Tunnel, only difference is app name for China.
*Thread Reply:* I wish there was something more exciting to their response
*Thread Reply:* Just to make sure, I was joking with the statement regarding the traffic sent to Chinese gov (even though it's not far fetched). Should definitely have added some mischeviously grinning smiley to the post.
*Thread Reply:* I knew that was the case, but as you said, it wouldn’t be surprising if that was the case. I still see this as being a workaround the China VPN issue by a name change. Maybe I’m wrong
*Thread Reply:* Also a sidenote: Hong Kong, which belongs to China but still has very many privileges, is not affected. Hong Kong has it's own App Store which is different from the China one and still includes MI Tunnel. Maybe this makes it easier for some companies which may be active in HK but not in the rest of China.
*Thread Reply:* That is interesting. That might explain why we have a test user in China who is still able to install Tunnel
*Thread Reply:* Do you have a reference article to this statement?
*Thread Reply:* No, I just switched an Apple ID around between countries. China and Hong Kong are listed separately. switching to China = no MI Tunnel, switching to Hong Kong = MI Tunnel
*Thread Reply:* So essentially, having an Apple ID associated with another country is a workaround, home country and physical location in China doesn’t matter...
*Thread Reply:* Well, we cannot know, if physical location matters, as I could not test that. I strongly assume that the Big Firewall prevents access to other country app stores on a network level, even if you switch your Apple ID to a different country. Also it's possible that iOS devices sold in China have a builtin prevention regarding switching AppStore country. Also this test does not shed any light on device-based VPP distribution as it is independent of the Apple ID. Customer will deploy a few test devices in Beijing soon, will update with our findings.
*Thread Reply:* We have a user in China, Home Country and Carrier both China. Apple ID associated in India. He is physically located in China, and confirmed able to access Tunnel. VPP is in India, so this may be why it is working, but I assumed the Great Firewall would be blocking it, it appears not
@thebjohn uploaded a file: Image uploaded from iOS
@Jason Bayton commented on @thebjohn’s file https://mobilxperts.slack.com/files/U1VJYP9S9/F8DCZSM1S/imageuploadedfrom_ios.gif: yup
@Woody uploaded a file: Pasted image at 2017-12-21, 10:39 AM
https://aws.amazon.com/alexaforbusiness/
Our network will require settings to get on the WiFi. Maybe disallow skills or integrations.
}
http://www.zdnet.com/article/my-favorite-iphone-x-feature-hidden-notifications/
*Thread Reply:* Yes we have seen the same. Also incorrect Home Countries, but that is already a addressed: https://community.mobileiron.com/docs/DOC-7477
Core 9.6.0.2 update appears to have killed my lab :(
*Thread Reply:* From my understanding, it is one or the other. The Box for EMM gives you the ability to push the plist file and use the Box admin console to control DLP. If you don't leverage and EMM then you would just use public Box app. Did that answer you question?
*Thread Reply:* I logged a bug in the beta portal but it's not even been sniffed at so far.
*Thread Reply:* It was nothing to do with iOS version, but agent version. Competing configs and one of them blocking app installations. There's a wider issue with the APNS losing connectivity as well. All bundled up into one "it don't work"
*Thread Reply:* System backup via the MICs is pretty bulletproof
*Thread Reply:* Was looking at backing up current core and restoring to the mam core
*Thread Reply:* So you should be able to run a system backup, then restore it to the mam server without the system settings. I haven't done it this way yet (always restore settings too) but it's been flawless each time.
*Thread Reply:* Yes but doing this requires to remove the APNS MDM certificate in the DB. Note that Core 9.7 will support MAM only on the same CORE
*Thread Reply:* Core 9.7 will support MDM + MAM only on the same Core
*Thread Reply:* how can you separate the configs?
*Thread Reply:* Didn’t tested yet but I’ve seen it the release notes in Centercode beta portal
*Thread Reply:* MAM Only
Ability to disable profile installation for iOS MAM-only devices
*Thread Reply:* You need to ask to your MI sales or system engineer
@Kiran Patel commented on @Barrie Codona’s file https://mobilxperts.slack.com/files/U7JE59F0B/F9C2FGZ18/image.png: Wow thanks, that was a brain fart on my end! Appreciate the help Barrie!
@Barrie Codona commented on @Barrie Codona’s file https://mobilxperts.slack.com/files/U7JE59F0B/F9C2FGZ18/image.png: You can also change it via the CLI from within the Configuration Terminal using the 'enable secret' command.
@Woody uploaded a file: @macbentosh from the Sentry 9.2.1 release notes:
@Woody uploaded a file: 9.6.0.0 Supported Sentry Versions
*Thread Reply:* Confirmed as beta release in Core 9.7, so fingers crossed!
Apparently partially based on our work with IronWorks, which was a pleasant surprise!
@Woody commented on @Jason’s file https://mobilxperts.slack.com/files/U7HRBAQGY/F9LM5PX52/imageuploadedfrom_ios.jpg: Congrats, Jason!
Looks like Cloud will be down for a while yet 🙄 🤔 😕 😬
https://stackoverflow.com/questions/40253751/ssrs-2016-native-double-hop-windows-authentication
*Thread Reply:* Did you end up on 9.6.0.2 or 9.7?
*Thread Reply:* Do you have collapse Docs@Work configs enabled? What types of issues are you seeing?
*Thread Reply:* @macbentosh going all vague-Slacking on us
*Thread Reply:* Q: How did you determine the issue is caused by security groups not getting recognized? A: When Devices try to access the share using Active Directory Groups they are not allowed. When they Active Directory User Account is then added explicitly they are now able to access the share.
Q: If you open up the permissions on one of the shares in question were you able to access the share without issue? A: Yes but only through a Workstation or Laptop. Both MAC and Windows machines are able to use the groups. Apple Mobile Devices are not
Q: What security group is in question (and is it a user or device based group)? A: These are Active Directory Groups, with Individual Users in each. There is no Nested groups involved.
*Thread Reply:* That’s odd, since you’re keeping it simple on groups (not nesting). What error do you see on the Sentry when the client displays this error?
*Thread Reply:* dunno logs were sent to MI….Still waiting. Per them there is nothing wrong as sentry is just a proxy.
*Thread Reply:* Gotcha. I think you went through this earlier, but said shares are using SMB 2.x+. Right?
*Thread Reply:* also that being said, security concerns aside do you know of any issues with leaving it at 8080?
*Thread Reply:* @Kiran Patel I’ve gone through this a couple times in the past. When you convert the provisioning port to 443, it basically just enrolls any new devices over 443 (SSL) instead of 8080 (HTTP)
*Thread Reply:* So, the only issue you’d encounter (after switching) is that if a device had enrolled using 8080 and tried to re-install their MDM profile, they would need to Retire/Re-Enroll (because the original profile was created/stored referencing 8080 which is no longer available)
*Thread Reply:* @Woody thanks man! It would also re-push SCEP certs and resync email right?
*Thread Reply:* No - The enrollment port only pertains to new devices coming in. Anyone who was already enrolled is part that point (and thereby not affected)
*Thread Reply:* really? We were told by support since the port is also referenced in the Local CA for the information URL & distribution point it would force certs to get re-created
*Thread Reply:* Provisioning port changes Local CA CRL endpoints to 443 port (which is by the way stupid...!) I don’t think it will regenerate certificates, except if there is a new way introduced in Core since few versions. I’ve done this without issues in the past too
*Thread Reply:* Ah yes, that’s correct @Kiran Patel. I forgot, it does update the CRLs from Core.FQDN:8080/CA to https://Core.FQDN/CA. It’s been a minute, but I’m with @NicolasR on not re-generating certs. I can spin-up an 8080 Core and check, if you like.
*Thread Reply:* Thanks guys, no need to spin up as I should be able to test this. Thanks again!
*Thread Reply:* Once set to 443, do not change it back, there's no reason to do so. If it is reverted back to 8080 new devices will fail to enrol. It's not obvious at first, usual troubleshooting,: checking MDM and Enrolment certs with much head scratching, until you look in System Manager and see it back on 8080.
@RobE commented on @macbentosh’s file https://mobilxperts.slack.com/files/U5BE2DYRH/FA2F3NW58/image1.png: Is this on iOS?
https://twitter.com/c_pellegrino/status/981409466242486272
}
Twitter
}
Twitter
WP8.1 and WP10, but not all of them it seems. When removing and adding back the email config it started to work again.
*Thread Reply:* Normally I've seen this when the end user has a Sim card pin active.
iOS won't allow wifi connections after a reboot until the device pin is active, and the Sim pin unlock comes after the device pin...
Try a different Sim card.
*Thread Reply:* Definitely not SIM related as they've replicated it on a number of devices. Supposedly the agent doesn't communicate with the device until after it's unlocked following a boot (paraphrasing).
*Thread Reply:* Never seen that. Typically as Simon said, its due to the fact the device does not have network connectivity: ie sim locked an no WiFi. If it has a connection it unlocks just fine in my experience. The agent does not need a connection: the command is send via APNs to the device directly, not the MDM client.
*Thread Reply:* I'm pleased to hear it's unusual I guess.
"OS won't allow wifi connections after a reboot until the device pin is active"
Isn't that essentially the core of this issue?
*Thread Reply:* That's BAU for iOS as until you unlock the device for the first time after a reboot, the wifi keys are all still encrypted in the keystore.
Now that I'm saying it out loud, it would case an issue resetting a password on a wifi only device that's been rebooted.
If the devices aren't wifi only though it does mean there's an issue somewhere.
*Thread Reply:* @Jason Bayton This is a known issue. MobileIron even put out a product bulletin on it (https://community.mobileiron.com/docs/DOC-7148). We have definitely experienced this on multiple occasions. Not just WiFi only devices.
@macbentosh uploaded a file: Screen Shot 2018-05-10 at 8.13.18 AM.png
*Thread Reply:* yes, it works… or atleast it did…
*Thread Reply:* Right on. It’s very similar to the Okta LDAP interface. I’ll see if I can get it rolling. Thx @Alex Mercer!
*Thread Reply:* Was literally trying to do this yesterday and don't think it's possible.
*Thread Reply:* Ended up using device name as our use case is to exclude a kiosk device if we want to kick it out of single app mode
*Thread Reply:* Unless things have changed, you can't nest labels within labels in MI. You have to create AD groups and exclude them or key off of AD attributes or another MI field (display name, device info, etc.).
*Thread Reply:* Not possible indeed. You would need some other attribute (device, OS or LDAP) to exclude it from the label.
*Thread Reply:* Basically the condition of label 1, just negated, in addition to the already existing label 2 conditions. For such criteria it is good to be able to manually design the search filter :)
*Thread Reply:* Contact Miriam Geller from MI. I asked for this years ago and she’s told me that it would be coming sometime.
*Thread Reply:* If I remeber it correctly, Miriam is no longer with MI.
*Thread Reply:* And the dream of nested labels departed with her it seems
*Thread Reply:* Shouldnt be an issue, as the MI CentOS kernel contains the Intel specific optimizations. If it is already working on AMD, everything should migrate well. I would have struggled the other way around. However, habent tested that yet.
*Thread Reply:* Probably worth being mentioned: Core and Sentry have different CentOS main versions. Will be equal again with Core 10.
*Thread Reply:* He says after making an authoritative statement on lack of support: "oh but I've never touched it" 😋
*Thread Reply:* I use it day in day out for my personal mail hosting, just never managed to find full activesync support despite looking.
*Thread Reply:* It's G Suite basic and above only. They've got docs covering it 👍
*Thread Reply:* to clarify by timeout i mean specifically AlertID HTTP503
*Thread Reply:* (AlertOrigin=Sentry, AlertId=HTTP503) Got exception during server-to-device processing, Sentry reporting error to client:Write timed out
*Thread Reply:* (AlertOrigin=Sentry, AlertId=HTTP503) Got exception during device-to-server processing, Sentry reporting error to client:java.net.SocketTimeoutException: Read timed out
*Thread Reply:* The only timeout tweaks I require adding were when proxying out to O365 (since there was obviously going to be some latency there)
*Thread Reply:* Anything on-premise (with 2+ CAS) always did fine with the defaults
*Thread Reply:* Hi Kiran, You can up those but id consider checking in with support if your running into issues after you up the timeout values. I usually try doubling the defaults for an issue like that and see if it helps.
*Thread Reply:* i.e 30000 to 60000 and 60000 to 1200000
*Thread Reply:* Have all network infrastructure in between allowing tcp idle timeouts of 1800s (MS recommendation). Other values work, but have to be consistent across all infrastructure.
*Thread Reply:* The 503 in general is normal behavior. E.g. an IBM Traveler would report a 408 conflict to devices. When a device is waiting for an update notification in a ping command, this connection stays open until the server responds or the tcp idle timeout is exceeded. However, if the device user does for instance do a contact lookup or whatever eas command, the existing ping command connection will be dropped by the eas server. This is translated to 503 by Sentry. Once the device‘s needs are fulfilled, it will issue a new ping command.
*Thread Reply:* 503 can have other causes, but in general it is normal behavior.
*Thread Reply:* I concur @Fabian, they do seem to be the accepted norm in this regard
*Thread Reply:* thanks everyone for the feedback on this. Appreciate it!
Core for supervised devices. Would block backups also.
*Thread Reply:* Thanks @Woody, true! how are you?
@Woody uploaded a file: Screenshot_20170425-134428.png
@Woody uploaded a file: Screenshot_20170425-134503.png
@Woody uploaded a file: Screenshot_20170425-142126.png
*Thread Reply:* Good to know, it seems the bug was never fixed…
*Thread Reply:* But if the users connect directly to the Exchange server FQDN why would that matter?
*Thread Reply:* I want to push it configured
*Thread Reply:* But it doesn’t support app Config, iirc.
*Thread Reply:* If you want to set the server endpoint automatically, I’m pretty sure GroundControl can set it via a one to many backup/restore.
*Thread Reply:* nvm just read the message before that
*Thread Reply:* I’d imagine they have to install appconfig at some point.
*Thread Reply:* I’m not aware that any MDM that has that capability. What platform are you looking at?
*Thread Reply:* F5 offers such TLS MITM when using RSA ciphers. But it does not work with PFS (DHE, ECDHE, etc.).
*Thread Reply:* I dock them next to my bed to charge every night (1 alarm is never enough)
*Thread Reply:* That’s right! I recall your bedroom was filmed for a Russian TV programme recently: https://youtu.be/NXvzhYnlTU0
*Thread Reply:* We talked about Skype For Business, do you know if it is possible for Microsoft Sharepoint for iOS. I can‘t find any infos which app supports it in technet!
SATIRICAL POST ALERT...
I feel like this could be a good story... what happened in the end?? Someone screw up??
"Disgruntled former admin installs Grindr to 100,000 employee phone the day he were fired".
*Thread Reply:* You can use “does not contain” search criteria if you want
*Thread Reply:* Is suggested to do something like: “common.userid” does not contain “svc” I’m not exactly sure about the search criteria but does not contain works
*Thread Reply:* there is not does not contain it’s does not =
*Thread Reply:* Just write it in the criteria ;-) You’ll see it works!
*Thread Reply:* In my lab things are ticking along ok, though the known issue around connector and ios don't affect me. In prod we run n-1 and most customers aren't even up to 9.7 as yet. Bring on 10.0.1.0..
*Thread Reply:* I'm hoping 10.0.1 does fix the issues we are seeing. The only Android issues we have right now are around the Mobile@Work client reporting all apps on the device be uninstalled and then reinstalled (this causes havoc with required app compliancy rules) and lack of Android 9.0 in-house app support with our 9.6 environment
Anyone familiar with this message for Docs@Work AppConnect? This is the first time I have seen this. Since when are the Google Play services relevant for AppConnect apps?
*Thread Reply:* This is within the iOS Restriction Configuration.
*Thread Reply:* what version of core are you on?
*Thread Reply:* This screenshot is from Core 10.0.0.2
*Thread Reply:* @macbentosh time to find out. Taking a snap and upgrading
*Thread Reply:* I’m on 10.0.0.2 with no issue, though 100% Android Enterprise and no LDAP so.. I really probably shouldn’t even add a voice tbh 😄
*Thread Reply:* Take in mind the die adminportal can only can be used by using the FQDN in Core 10 (not ip oder another dns record). Beside that, its a 70/30 thing. Most times it runs smooth. On other installations nothing works after update (Core does not boot, DEP broken,...)
*Thread Reply:* Thx for the update @Kiran Patel. So, technically not related to Sentry itself… but the VM environment that it lives in. Right?
*Thread Reply:* yup but technically if the VM appliance puts itself into RO mode a script running on it shouldn't be able to consume all resources
*Thread Reply:* Should be a pre-flight check on the script side
When a DEP enrolled device restores a backup how do you tell what device to retire?
*Thread Reply:* My bad, It can be changed. I do see that you got your response 😊
*Thread Reply:* No but do let me know how you get on!!
What projector are you playing with? Not just a case of side loading the agent?
*Thread Reply:* Wait. Android Projector? Interesting!
*Thread Reply:* That’s awesome. I never really figured that would be a market we’d see Android on. There is that open source project though, so I guess it was bound to happen eventually!
*Thread Reply:* Seems to run android 7.1 I don’t see why you couldn’t side load an agent... not sure what control you’d get over it though
*Thread Reply:* Love to see the results though!
*Thread Reply:* I just want to block apps and add wifi
*Thread Reply:* anyone have the latest apk handy
*Thread Reply:* I've enrolled the Xperia Touch and it locks down lovely.
*Thread Reply:* https://support.mobileiron.com/MIClient-latest.apk
*Thread Reply:* Now I need a whole new set of policies
*Thread Reply:* Hmm, and what’s Android not doing with that?
*Thread Reply:* Do you see the certs pushed to the device at least to begin with?
*Thread Reply:* Are the relevant certs assigned to labels?
*Thread Reply:* they dont get applied just told they can trust it.
*Thread Reply:* If in doubt, assign to labels; like Windows Phone, things like SCEP need to be assigned directly to the AE device label(s), so I’d rule that out
It does seems like it is feasible here (https://docs.microsoft.com/en-gb/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune) but isn't that limited to Intune? What about MobileIron?
*Thread Reply:* Yes, but it has to route via the MS Authenticator app I believe.
*Thread Reply:* ok, Did not think of this one. Thanks. Will investigate
*Thread Reply:* @JF Rigot so you are wanting to deploy a CBA Exchange Configuration to iOS/Android for ActiveSync and then have a similar experience the Outlook (modern) clients. Correct?
*Thread Reply:* Are you using MobileIron Cloud or Core?
*Thread Reply:* If you’re able to, I would begin considering walling-off ActiveSync. If it needs to stay around, go the CBA route. For Modern, your best bet is to use MobileIron Access and it’s Mobile SSO feature.
*Thread Reply:* Thanks Mark for the quick reply. Sounds great! 🤙
@here
}
Apparently I am not finding enough time for this Slack 😞 So apologies for responding to a request from a few days ago. But I thought this might be helpful for some...
You can use Epoch/Unix millisecond timestamps in elasticsearch filter criteria. An example:
"common.registration_date" >= 1542240000000
All devices registered since yesterday.
}
*Thread Reply:* I have created the payload with the AC2 - these are active:
*Thread Reply:* Oh, in the settings on device I can see that the payload is different: Unmanaged apps read manage contacts allowed - what the hell? It is set to false in the XML.
*Thread Reply:* ok now I have only the one option :
*Thread Reply:* If you can spot the mistake let me know!
*Thread Reply:* I understand now indeed. The contacts that are exported from Email+ to the native contacts, are unmanaged contacts. So any app can read them after they have been exported. Only managed contacts are not shared with unmanaged apps.
*Thread Reply:* Yikes. That means there is no solution for this?
*Thread Reply:* I thought if the contacts came from a managed app they are also managed contacts..
*Thread Reply:* They are unmanaged. One rule is to allow for apps to export contacts to the native contacts app. At that point they are unmanaged. The other rule allows for unmanaged apps to access managed contacts. That only works for managed contacts (ie mdm pushes Exchange configs). I do not see a solution with those two rules for your use case. You have the most options if you use the native apps instead of email+ for this use case.
*Thread Reply:* You are right.. So at the moment for GDPR compliance and car Bluetooth caller id lets stick with the native client.
*Thread Reply:* Known issue without impact. Fixed in core 10.2
*Thread Reply:* As long as the shares mailbox has an ad username you can deploy it and access it via activesync.
You are limited to only 100 devices though as this is the maximum activesync devices exchange will allow on any single mailbox.
We only do it for very occasional requests but deploying down the account with credentials preloaded into the settings.
*Thread Reply:* But does a shared mailbox have a password? Because It gets mapped automatically without using credentials within Outlook. It is not an AD user account, right?
*Thread Reply:* Not natively but you can convert it to a different what is essentially a service account details.
It will need its own licence though.
*Thread Reply:* Shared Mailboxes are more and more requested by customers. We are using the native email app on iOS. It's working well with Kerberos. There is also a known-iOS issue if multiple exchange profiles are using the same activeSync address (sentry.mydomain.com), so as a workaround we are using DNS aliases to make sure there is no synchronization problem, e.g. sentry1,sentry2 etc. pointing to the same IP address. Of course the SSL certificate has to include SAN attributes. For Android Enterprise we recommend the setup with Email+. Also working fine with Kerberos. In all cases we need to manually allow the activeSync association, since the device is not registered with the same user ID has the mailbox. Drop me an email if you need more information!
*Thread Reply:* BTW: mobileIron has the shared Mailbox feature in Email+ iOS on the roadmap since more than a year...and it always get postponed.... so I have some doubts it will be ever implemented...
*Thread Reply:* Yes I think this is on the roadmap for Outlook too... They've released the feature to access the shared calenders a few weeks ago. So mailbox access should follow.
*Thread Reply:* Wow Alex, that known iOS issue passed by me, thanks for the info! Do you have a reference for that bug? So you did enable the shared mailbox user accounts and then use a costum attributes for the passwords within the exchange and AE Email+ configs, right?
*Thread Reply:* @Alex Chappuis this is what we did for those situations as well. Happened to have a wildcard certificate, so just created a new DNS entry and forwarded to the Sentry. Administrative Assistants were never so happy as they were when we rolled that out.
*Thread Reply:* @RobE I don't have any :apple_icon: tracking number but just try to distribute two configurations on a single iOS device (with the same backend URL) - you will see that iOS is mixing the inboxes and does not behave as it should! we don't need any password since we are using Kerberos. We are using dedicated SCEP template with hardcoded User UPNs and DNs. That's the beauty of EMM Admin's power 😲 the SCEP Master has simply access to any mailbox (this is btw a risk that has to be explained carefully to the customer). We did not need custom attributes. Just hardcoding some parameters and using the variable $NULL$
*Thread Reply:* Right, should have read Kerberos in your posting 😂
*Thread Reply:* We just got confirmation from Apple that the client is no longer available in China. This is what our users are seeing:
*Thread Reply:* there used to be a similar issue for MI tunnel back in time, it's been replaced by MI Centaur: https://itunes.apple.com/us/app/mobileiron-centaur/id1315143363?mt=8 Or https://community.mobileiron.com/docs/DOC-7346
*Thread Reply:* I don't know if there is also an alternative for M@W
*Thread Reply:* you should ask MI directly!
*Thread Reply:* We’ve got cases open with MI and Apple. The workaround for us will be using clientless (ireg) and pushing the client using VPP.
*Thread Reply:* @Phil Hackett In that scenario, would the client derive from a US-based App Store or the China instance?
*Thread Reply:* If it tried to pull from the China instance, wouldn’t it fail?
*Thread Reply:* Might be time for MobileIron to update the “Mobile@Work In-House SDK” offering
*Thread Reply:* https://community.mobileiron.com/docs/DOC-9162
*Thread Reply:* Symptoms: We have received reports that the Mobile@Work application is no longer available in the Chinese App Store beginning on 21 November 2018. Resolution: MobileIron is investigating the cause of this internally and this document will be updated as new information becomes available. The Mobile@Work application remains available in all other regional App Stores.
*Thread Reply:* We are able push the Mobile@Work client using device-based VPP. Not sure if this works because our VPP account is from US?
*Thread Reply:* IIRC Apple said the VPP would follow wherever the top-level account was established
*Thread Reply:* It’s been awhile since that conversation was had tho
*Thread Reply:* We are assuming the same as well. I’ll throw this question to Apple account manager next week.
*Thread Reply:* Wow that is news to me. What about migrating an existing Core with round about 10.000 devices to a new Core on a different location ? My plan would be: create a new Core VM (same FQDN) on the new location with the same software version, set all the Firewall rules for the new Core. Export a System backup from the old Core and import the backup into the new Core. Last step switch DNS over to the new one.
*Thread Reply:* Just make sure, when you restore the backup, to select "Exclude System Configs on Restore". Assuming your new Core in a different location, will have a different system config (IP address, interfaces, routes, etc.)
*Thread Reply:* I see this error on many Core 10 servers. I always assumed this is because the device(s) might not be supervised (and the Scheduled OS Update command is for supervised devices only)
*Thread Reply:* Might be, we still have some unsupervised devices (one of the tenant of our MI server does not believe in DEP and finds it “too hard”)
*Thread Reply:* Yeah, in that case I would ignore the error.
*Thread Reply:* This is resolved! we double check everything and there “www” missing in identifier (entity id) url
*Thread Reply:* Agreed. You need an idp in there to govern this. Alternatively you link the AD group which grants access to the app, to the deployment of the tunnel. This means that once they have the rights to access to app, they also get the vpn.
No access, no vpn.
*Thread Reply:* Right, thanks Simon. I thought there could be a way to lets say create a tunnel config for backend a, trigger for backend a, but ignore everything for backend b. But that doesn’t seem to work. There will not be a user without Tunnel being deployed, because everyone is using it - only with different backends.
*Thread Reply:* Though I wonder... I’m not sure how mobile iron sets up the tunnel... can this be setup with a certificate for authentication?
*Thread Reply:* Yes every user has an identity certificate
*Thread Reply:* This is typical use case for an intelligent reverse proxy such as F5
*Thread Reply:* Sentry is not designed like this
*Thread Reply:* Yes, agreed. In my case it is only Safari. Ok, then I have to take a look into the Tunnel VPN test configuration for missing or wrong settings, because right now I only configure one backend but manually entering another backend also works.
*Thread Reply:* You have to restrict the safari domains so that only the allowed app / url is allowed. The rest will be send to the internet and not the tunnel. So, be more exclusive/restrictive.
*Thread Reply:* How exactly would you restrict the Safari domains within the VPN configuration? I don’t see how this can be achieved and the Tunnel guide is not much help either. Tried it like this:
*Thread Reply:* Never connect for forbidden backends and connect if needed for allowed backends
*Thread Reply:* The guide says for on demand rules: “VPN on-demand rules are applied when the device’s primary network interface changes, for example when the device switches to a different Wi-Fi network”..
*Thread Reply:* That screenshot does not apply to Safari domains, it only applies to the Per App vpn connections. Below that you would see a paragraph called Safari domains. Here you would enter the domains. Say the domain is domain.com and you would like to grant users access to appA.domain.com but no other hosts in that domain, then enter in the Safari domains appA.domain.com. If you enter, for example, domain.com, the vpn will be triggered and the user can access any host within the domain.com domain.
*Thread Reply:* Agreed.
This should be all controlled at the app access level. If you're not approved to use it, then you shouldn't be able to login even if you can get to the login screen.
Common sense
*Thread Reply:* Totally agree with you guys! 👍:skintone2:
*Thread Reply:* You mean a way to automate device list export to an SFTP?
*Thread Reply:* I would say Assemble task + save to an SFTP drive
*Thread Reply:* For completeness, this is also possible with IronWorks (https://ironworks.io/) but with the added disclaimer that this is our solution… 🙂
*Thread Reply:* Sorry... Have to chuckle...
My wife is one of their in-house legal team... They're a French brand (2nd most popular brand after Samsung here in france) and their HQ is here in Marseille!!
They do support Android Enterprise with Gmail, can't speak as to mobileiron though but shouldn't see why there would be any issues.
*Thread Reply:* @Simon Hardy-Bistagne does she want to send a few samples my way for testing? 😁
*Thread Reply:* Shouldn't see why not. I'll get her to drop their PR folks a request. Will drop you a PM
*Thread Reply:* You could try and repush the Apps@work certificate profile as detailed here: https://community.mobileiron.com/docs/DOC-1957 But that never seemed to fix it at customers and was only resolved with a factory wipe.
*Thread Reply:* Ouch that is not fun, I heard rumors the Cisco AnyConnect app was actually able to find and give users the ability to delete an orphaned cert. worked for me prior to iOS 12 but only recall using it twice
*Thread Reply:* It has been at least a year since I used it but here are the steps I used with Cisco AnyConnect
*Thread Reply:* 1. Download Anyconnect, 2. Select diagnostics at the bottom of the screen, 3. Select Certificates, 4. Select edit at the top right, 5. Select the red circle with the white dash for the cert you want to remove, 6. Confirm by deleting delete to the right of the cert, 7. Select Ok
*Thread Reply:* Thanks @dustinclark. Same steps I used to do... currently it’s not seeing the orphaned cert though.
*Thread Reply:* It’s so that you don’t have to expose your on-prem AD servers to the public internet.
*Thread Reply:* You mean in case of Cloud, right? We are using Core, so I don‘t have to publish my AD servers for LDAP requests - at least I would have to open the ports for the DMZ if Core sits only in the DMZ.
*Thread Reply:* you would have to open up the LDAP port on the firewall between DMZ and your AD server. With a connector on the same side of the Firewall as where your AD is you don’t. the connector, opens a port 443 connection to the Core. the firewall sees this as an inside out connection. the LDAP traffic from the core to the AD server inside that 443 connection opened by the connector is considered return traffic. When configuring your LDAP servers you do not have to tell Core there is a connector. If core cannot reach the LDAP server directly it will check if there is a incomming connection from a connector and will try that one to connect to the LDAP server. you can even setup multiple connectors for redundancy
*Thread Reply:* Update to 10.1.0.1 did NOT fix the problem. Still same errors; 2018-12-18 08:09:08,904 ERROR [systemWd] (ECSystemWatchdogThread.mainServiceLoop:80) - Some threads not healthy for service: ECServiceHealth:ldap, numThreads - Configured:4, Created:4, Running:3 Exception in thread "ldap2" java.lang.OutOfMemoryError: Java heap space
*Thread Reply:* We’re about to do this with airwatch and intune...
Interested to hear your thoughts
*Thread Reply:* for now I'm testing the API calls
*Thread Reply:* we will certainly configure it in preproduction in january
*Thread Reply:* We did it @ Kindred about two years with Core. Included some custom SAN values in the certificates for ISE to identify ownership of device to assign accordingly. Was a pretty clean setup. @Jonathan Henson and @japple can speak to how its been behaving over the long haul.
*Thread Reply:* FYI, the API call is case sensitive and this one works: /api/v2/ciscoise/devices?paging=0&querycriteria=macaddress&value=A85C2C317842&filter=all
*Thread Reply:* le "C" of querycriteria is lower case
*Thread Reply:* Afraid I can't help with the remediation aside from investigation of the destination ip to ensure it really is a known CNC server and raise it with mobileiron.
Do you have the destination address of the CNC service it's connecting to?
*Thread Reply:* I wouldn't be surprised if this were a flash positive
*Thread Reply:* Thank you for the answers. I hope it is a false positive, too. Will try to open an issue with MobileIron and check with them.
*Thread Reply:* In the report it looks like this:
*Thread Reply:* It looks like incoming and not outgoing connections, correct? Because the source IP are not the MobileIron servers (I assume these are the ones covered in red)
*Thread Reply:* Are you sure the source IP addresses are in use by your MI servers? I see 4 addresses and you say there are 3 servers.....
*Thread Reply:* Deployment Docs still state that the only outbound connection Sentrys should make by default (obviously changes if you have hosted email/etc): support.mobileiron.com (199.127.90.0/23) for software update repository and SFTP upload of showtech log
*Thread Reply:* Agree with @Mark Vonk and @Almar Diehl - Those look like inbound requests from external hosts attempting to connect to the Sentrys on TCP 80
*Thread Reply:* Yeah... I'm even more sceptical now I see them...
From the ip's I see your sentey is being scanned on those ports by someone hosted on an Alibaba cloud service.
Looks unlikely that you've actually been compromised.
*Thread Reply:* @Almar Diehl One IP was listed twice, that´s why there are 4 lines (there are pages full of these lines in the report)
*Thread Reply:* Anyway, port 80 (incoming, so from Internet to the Core and/or Sentry servers) should not be opened. Block by default. There is nothing running on port 80 anyway, so there is no harm. As Simon said: the 4 IPs are from China (Tencent Cloud Computing mainly). So nothing really happening, they are just trying to find a weakness. In all honesty, it would be surprising of your firewall did not detect such behaviour continuously....
*Thread Reply:* Yes, 4 different source IP addresses. As said by others this looks like an attempt to contact your MI servers from the internet on port 80.
*Thread Reply:* The firewall (Cisco Firepower) was implemented just in the last few months, so we don´t have a feel yet for what is “normal” and what is not. Also, the firewall rules for the sentries were put in place when we first installed them 6 or 7 years ago, so it is possible that port 80 is open (might have been necessary then). Will check that and close 80. What I wonder is how it gets the idea that there were outbound connections to those servers when the report says they were inbound….
*Thread Reply:* I think it is just your network admin that got that idea, not the firewall 😁
*Thread Reply:* Might also be 🙂 But it is listed in the Malware report from the firewall as “Intrusion Event - Malware Backdoor”
*Thread Reply:* Port 80 has never been a requirement in the time I have been working with MobileIron. Neither for the Core or the Sentry. Despite that, it might be a good time to check the firewall rules for MI servers and update them. Some port are no longer needed or used (like 8080, 9998) which where needed 5 or more years ago.
*Thread Reply:* Yes, will check that with our firewall admin, now is a good time for a review of these rules (many of which are outdated, as you have guessed correctly)
*Thread Reply:* If the servers are infected with Webshell malware, the malware might be opening port 80 to allow for remote administration of the server. See: https://www.us-cert.gov/ncas/alerts/TA15-314A The message from your firewall and engineer are not really clear. Better have them check and see what's really going on (ie. what is actually seen from a dataflow perspective)
*Thread Reply:* Just tried a portscan against the three servers, port 80 is open on all three…:-(
*Thread Reply:* Have you network admin block port 80 to all MI servers
*Thread Reply:* That would be step 1. Step 2 would be to determine if your servers are infected. It could have previously been infected; the malware abuses common ASP, JSP and PHP code execution. So they could have used that on the Core/Sentry using JSP (MI uses JSP on Tomcat) to infect the servers with the malware. Best thing to do would be to involve either MobileIron support or some security expert with Linux knowledge and have them assess if they are infected.
*Thread Reply:* Agree with Mark. As the ports are open, it's better to close off those ports immediately and monitor your server activity out to the web.
Also get mobileiron involved to check it out
*Thread Reply:* Will open a call with MobileIron Support and have them take a look, Thank you for your replies!
*Thread Reply:* Try and see if your firewall admin can save the logs (hopefully, the full HTTP requests are logged). That would make it easier to find out if the servers are infected. Once the malware is installed, the people will try to access the servers using port 80 and leave files behind that do not belong to MobileIron. With the HTTP requests in detail, it would be easier to find the files. It did not look like something serious, and hopefully its not. But it might be more serious than I made it look like before. Good luck !
*Thread Reply:* And let us know the outcome please.
*Thread Reply:* PS. also make sure to configure and use the ACLs (portals, API, etc.) on the Core (System Portal) if you haven't done that already.
*Thread Reply:* on the core CLI (tcp), I see lots of connections on port 80 (SYN_RECEIVED) to an address in California (23.234.39.87)
*Thread Reply:* will check the other recommendations and will report back tomorrow night….
*Thread Reply:* A brief search says that ip belongs to a Chinese owned, us based hosting company who target mostly Chinese customers who need hosting in the US.
*Thread Reply:* That’s what I could find out, too. Thank you!
*Thread Reply:* OK, just heard back from Support, there is no nefarious things on the Core and Sentries, and we closed Port 80.
*Thread Reply:* Great to hear!
I think it's a good warning to all of us to make sure that we have a regular review of open ports. Especially if we have had our servers in place for a while.
*Thread Reply:* How many DNS servers did you configured and are these ones internal or external?
*Thread Reply:* you should look if they are always able to resolve internet names. I've not seen such issues an "UnknownHostException" is due to DNS resolution
*Thread Reply:* Thanks I will.. makes sense
*Thread Reply:* Darn! That was a fairly useful tool for basic remote administration
*Thread Reply:* #MobileIronTeam, any insight?😊
*Thread Reply:* I believe that they stopped development on it a while back. I left mi about 8 months ago, so my info may be out of date, but that was the status when I left.
Found this, but the links is not working anymore
https://community.mobileiron.com/docs/DOC-1843
- (never tested) https://github.com/garymcconnell/mobileiron-nagios
And/Or MobileIron Monitor (which lack of some features for now but very useful for deep insight on Core performance)
*Thread Reply:* ok, and do you know where to find these logs and how to gather them?
*Thread Reply:* This is legacy. It was only for Samsung KNOX API devices (old APIs known as SAFE). You will need to create a SMS and Phone call log system (email, syslog, splunk, etc). Check the Android management guide for your Core version
*Thread Reply:* Mark are they deprecated in Knox now? Presumably when core supports the unified APIs this will work with Samsung in AE also?
*Thread Reply:* Not sure, as these are not KNOX APIs but former SAFE APIs. Not sure if these will continue to work (without Device Admin) with KNOX 3.0 or higher.
*Thread Reply:* yikes, this is pretty interesting news! Thanks @Mark Vonk 🙏
*Thread Reply:* Yes, this is a known issue. It does not warn you, even not during the Verify stage. There is a document on the communities site on how to enlarge your partitions.
*Thread Reply:* Thank you Mark. Yes I have seen that document and I gotta say this is pretty rough and tough.
*Thread Reply:* Yeah, take your time and make sure you have backups and snapshots. If you don’t want to take the risk: set up a new Core, same version, with enough disk space and perform a backup of the old and restore it to the new server after shutting down the old one. That way you always have a fallback scenario.
No, I am using the AE version, see the screenshot.
*Thread Reply:* I don’t see the calendar weeks in your screenshot either!
*Thread Reply:* Here you can see the calendar weeks on the left hand side..
*Thread Reply:* Ah, now I see what you mean by ‘Calendar weeks’. No, this is (still) not available.
*Thread Reply:* But what I see in your screenshot is in email+ the month view. In my screenshot you see the month view in Email+ 3.0 (beta), that also includes the weeknumbers!
Found this in Apple’s documentation, so that correlates to “Allow user to enable restrictions in Settings UI” in the iOS restrictions policy on MI Cloud.
*Thread Reply:* I wouldn’t say we had to but we are testing it right now for a few users in Prod
MobileIron issued a press release about their new SVP of product management. Anybody read any significance into this? Or just business as usual? https://www.businesswire.com/news/home/20190116005042/en/MobileIron-Appoints-Brian-Foster-SVP-Product-Management
*Thread Reply:* Because if someone makes a typo in the mobile number to use it would send the registration pin to the wrong person, giving this person the opportunity to register a device.
*Thread Reply:* Makes total sense! Thanks Almar 👍:skintone2:🙏
*Thread Reply:* Policy out of date, device not checked in, compromised, passcode not set... Likely more but can't think offhand
*Thread Reply:* I'm not sure if these map into MI, but for I have used the following regularly.
Compromised: Enterprise wipe Device last seen: Enterprise wipe after X days Encryption: Notification + Block profile > Enterprise wipe Roaming: notification email to TEM provider OS Version: Notification with update instruction > block profiles Passcode: Notification + block profiles > enterprise wipe Personal macOS: Block + Notify
We also have various compliance policies around lookout where unless the app is installed and active then the user is blocked from most profiles and notifications get sent, along with various actions based on threats detected by the MTD.
*Thread Reply:* Right, thanks Jason. Policy out of hand, device not connected to Core could also be used in a Security policy. But due to Tiered Compliance you prefer Compliance policies, right?
*Thread Reply:* iOS: not possible Android: only Work profile devices act like this
*Thread Reply:* Probably a way with Assemble
*Thread Reply:* Nop, the number of failed attempts is not reported on Core, therefore assemble can’t use it
Is there an app limit in the MI kiosk @here?
}
*Thread Reply:* Thanks @Jason Bayton & @NicolasR 🙏
*Thread Reply:* Thats an automated cleanup; the same device for the same user has been registered on the Core multiple times. Core automatically cleans up the oldest registration(s)
*Thread Reply:* Any particular brand or type of device you are having an issue with? Never seen that before.
*Thread Reply:* All of them are Samsung devices, different models
*Thread Reply:* Was this fixed after you fixed the connection to Google wrt Android Enterprise?
*Thread Reply:* No that was a different environment
*Thread Reply:* Any known timeline about this?
*Thread Reply:* Any article about this old API case?
*Thread Reply:* You should've received an email on it: http://pages.mobileiron.com/DOGu10V0HIX00t0GlW0g0cI
*Thread Reply:* ok, this one, thanks 😃
Can anyone explain to me what that indicates? We deploy a lockdown policy for Android, where these features are enabled. Not sure what disabled means in this context.
*Thread Reply:* I have enrolled the device via DPC, so it is work managed COBO. The lockdown policy is „Applied“, but a lot of values have the ❎
*Thread Reply:* But also some of them are ✅
*Thread Reply:* That which is currently blocked on the device according to the screenshot, can you test it?
*Thread Reply:* Re-Enrolled the device, looks better now.. weird.. thx.. do you have experiences with printing from the Work Profile? It looks like it is not working trying to connect a printer via Bluetooth from within the Work Profile.
*Thread Reply:* My only experience is either utilising cloudprint, or apps like the epson/hp print enabler. Beyond that.. I certainly haven't tested via bluetooth
*Thread Reply:* Found this: https://community.mobileiron.com/docs/DOC-9134
*Thread Reply:* Good catch! There's your answer then
*Thread Reply:* Yep, this AE service test fails on our Core’s as well. It’s a known issue for Core 9.6-10.1. It should not impact AE device management. https://community.mobileiron.com/docs/DOC-8547
*Thread Reply:* Ughh turned out to be some massive query AD groups were removed from enough i users “member of” attribute even though we aren’t using those groups in AD. Learn something new everyday!
*Thread Reply:* If you're being promoted for login suggests VPP isn't taking precedence over the standard label assignment.
Have you tried renewing and readding VPP? Maybe on a test app try assigning only to the VPP label and not the standard? (That dual-label assignment was a bug)
*Thread Reply:* Not sure what you mean about the dual label part
*Thread Reply:* renewing VPP? Re-import the token?
*Thread Reply:* In core you assign the app to a label, then assign VPP to a label.
*Thread Reply:* Wasn't tooooo long ago you'd only need to do the VPP label and not the app label.
*Thread Reply:* we have a blanket vpp label called Apps …All devices that are eligible for VPP apps. Then we advertise the app to the people we want to with a different label
*Thread Reply:* Gotcha. The user needs to be an Admin? No registered device necessary for that user?
*Thread Reply:* You do not need to give the user any admin rights or register a device against it. Just in the event you are monitoring in the admins section search for the user.
*Thread Reply:* In terms of iOS devices and what EMM platform?
*Thread Reply:* @System Admin your best bet is going to utilize whatever 3rd party VPN service you have, deployed via JAMF (e.g Cisco AnyConnect. Pulse, etc)
*Thread Reply:* I am not Sure just I come to know CISCO Wireless HW
*Thread Reply:* OKay @System Admin. Ask about your entitlement to ISE. That’s what would make the biggest difference when used with an EMM
*Thread Reply:* Thank you @Mark Vonk . Self Signed SSL Cert also enough, right?
*Thread Reply:* Yes that should be OK. Depends on what reporting service will talk to the RDB using what kind of protocol. But self signed is typically ok
*Thread Reply:* The H2 on Alexanderplatz is pretty good
*Thread Reply:* Hotel NH Berlin Alexanderplatz
*Thread Reply:* MI have a KB article on how you can deal with this: https://community.mobileiron.com/docs/DOC-7771
*Thread Reply:* We are looking at increasing the time window that a user has to launch the Mobile@Work app after DEP enrollment. MI recommended setting this at 1 week maximum. But there are customers who have it set to 6 months….
*Thread Reply:* okay, ive been in contact with MobileIron, and they said to be careful with the window due to not filling the database.. but having it set to 6 months sounds perfect 🙂
*Thread Reply:* Only if you wish to have different configs for different user/device groups.
*Thread Reply:* Right, good point. I am thinking if this could cause issues where in some cases apps would end up without the config on the device depending how the order is within the Core queue? Also I can achieve that with Label A for Config A + app and Label B for Config B + app. I don’t see the pros. I have seen devices where Email+ drops the error „no config“..
*Thread Reply:* Yeah as @Almar Diehl mentioned--it’s usually best to keep the App+Configs under a single label, unless you have multiple configs for different regions, LOBs, etc.
*Thread Reply:* Hello,
Very good article for identity management in O365 apps on MobileIron
Android https://www.mobileiron.com/fr/blog/solving-office-365s-multi-identity-crisis-android
iOS https://www.mobileiron.com/en/blog/solving-office-365s-multi-identity-crisis-ios
*Thread Reply:* Is this a hardware appliance or VM? Which version of Core 10 are you trying to upgrade to?
*Thread Reply:* It is a vm. So 9.7.0.2 to 10.0.0.3 failed.thanks
*Thread Reply:* @SebastienP When do you observe that error? During the staging before the system reboots, during the attempted upgrade, etc? Have you stepped through the database validation and received a successful outcome?
*Thread Reply:* On reload and written into upgrade.log file. Cli don’t output failed. Database seems to pass because schéma is validated in 9.7.0.0 « no upgrade required »
*Thread Reply:* Dear all problem is solved. Boot was the problem. 462 Mb free space was needed. My partner moved partitions and extended boot partition. It was written in the log but we did not catch it onto the video
*Thread Reply:* I used port 7443 without issues. As far as I know mutual auth with Android Apps@work is not enabled until Core & Client 10.2 Is it your case?
*Thread Reply:* M@W 10.2 is for sure needed. Not sure about Core 10.2 as a prerequisite.
*Thread Reply:* Ok I might consider upgrading to Core 10.2.0.0. we cutten have 10.1.0.1
*Thread Reply:* Solved - our Firewall Engineer messed up the rules so the user cert somehow got stripped due do SSL inspection feature. Weird that this affected only Android!
*Thread Reply:* Browsing 9443 brings me the external trusted Portal certificate from Core.
*Thread Reply:* Only what is described in DOC-7604
*Thread Reply:* Check out page 203 and further of the Android device guide for Core 10.1 or higher and make sure to read and configure all that is needed. For instance: However, Apps@Work for Android uses mutual authentication only if you do both of the following: • Select Certificate Authentication at Apps > Apps@Work Settings > App Storefront Authentication. • Enable the mutual authentication setting at Settings > System Settings > Security > Certificate Authentication.
*Thread Reply:* Also read the paragraph “Migrating Mobile@Work for Android to use mutual authentication” See: https://community.mobileiron.com/servlet/JiveServlet/downloadBody/9349-102-2-33162/CoreDeviceMgmtAndroid10200_Rev17Jan2019.pdf#page197
*Thread Reply:* Thank you @Mark Vonk .. checked all these settings yesterday afternoon and everything is setup like the way it is described. @NicolasR We use Core 10.1.0.1 and M@W 10.2. Will do further troubleshooting today
*Thread Reply:* You are absolutely right Woody, but I have still 200 zebra devices without GMS on them, so no AE possible 😢
*Thread Reply:* I’m fairly certain Zebra enables DO based enrollment outside of GMS through StageNow
*Thread Reply:* https://developer.zebra.com/thread/35648
*Thread Reply:* “Device Owner is supported on AOSP and have the Device Policy Manager APIs available to take advantage of OEMConfig. However, Google Play services APIs are not available on AOSP devices.”
*Thread Reply:* So you can use AEDO with AOSP on the Zebra Android devices but you obviously can’t distribute LoB apps through Managed Google Play since there are no GMS features
*Thread Reply:* You also can convert Zebra devices between GMS and AOSP if you really needed to.
*Thread Reply:* Wow 😮.. that is news to me! Thanks Matt, I will take a look at this. Zebra :zebra_face: is a pretty fresh topic for me! 😨
@macbentosh a couple of documents for you to reference - 1) https://community.mobileiron.com/docs/DOC-1806 2) https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune
*Thread Reply:* So, are these machines running the Windows 10 or Windows Phone platform?
*Thread Reply:* You can just add Context header but Context Header doesn’t work with TCP Tunnel and IP Tunnel
*Thread Reply:* You can change it in the system settings to 90 minutes.
*Thread Reply:* @NicolasR HI,iOS users are unable to open protected documents when App protection policies(Graph API) are applied.We are using iOS native mail client and we also have Access(AasS).Also,i am facing issue configuring policies to stop multi identity .I have configured values as shown below, IntuneMAMUPN --- $USER_UPN$ intuneMAMAllowedAccountsOnly ---Enabled
*Thread Reply:* @NicolasR Are you using Outlook or any other email clients on devices?
*Thread Reply:* Devices & Users > Users > Resync with LDAP
*Thread Reply:* Nice, was looking on the Service > LDAP tab 🙂
*Thread Reply:* Multiple reporting methods depending on your needs from the most basic one to the most advanced. From the simpler to the best/complete reporting experience 1 - Embedded dashboards 2 - Assemble (kind of End of life by the way...) 3 - Reporting Database + BI Tool 4 - API - requires you to build your own scripts 5 - Third party IronWorks product
*Thread Reply:* BTW, I know they may be trying to EOL Assemble… but there is still a lot of that deployed/running. Might be in their best interest to maintain support if they’re being mindful of customer satisfaction
*Thread Reply:* at least MobileIron is not providing new features on that
*Thread Reply:* @NicolasR that’s understandable. While it wasn’t perfect, it certainly helped with a fair amount of cleanup and automation, etc
*Thread Reply:* Also, they might need to expose more in the API and document it better to be a complete replacement for Assemble.
*Thread Reply:* They need to both incorporate more features from Assemble into the base code of their products AND expose similar functions (and supporting documentation) in regards to the API
*Thread Reply:* Once Jack Zarris left, there really was no one who could maintain or add new features.
*Thread Reply:* Just create a support case and they will send you the credentials.
*Thread Reply:* So from where you downloaded the sentry iso impage file. ? For downloading the image file on your computer, i am sure, it prompted to enter the username and pwd to download the software. You can use that same credentails to update into GUI or CLI. But make sure correct port is open.
*Thread Reply:* When you bought MI licenses they sent you download credentials. Do you know who is the main contact for your company? If not just create support case with MI. But good partner should help you with this situation.
*Thread Reply:* In the security policy you mean?
*Thread Reply:* Ah sorry was not clear enough - within Core Admin Portal under Settings / User & Devices / Registration / Passcode Expiry (hours)
*Thread Reply:* Maximum is 4320 hours (180 days).
*Thread Reply:* Thank you Almar 👍:skintone2:
*Thread Reply:* Everything up to the point of putting in credentials. Screenshots of the setup of the device. I appreciate it’ll vary with DEP per enrolment profile, but I can write around that.
*Thread Reply:* This issue is, for example, that the Apple Assistant will vary also, on the choices made. Some companies will skip certain screens, others will not skip them. Screens like the MDM enrolment will show company names. Other documentation will show how to connect to the corporate Wi-Fi (if needed). hence, there is a lot of customisation typically.
*Thread Reply:* well with a non-DEP guide I can remove per the DEP profile and hopefully that’ll be close enough 🙂
*Thread Reply:* We haven’t met before, but I only focus on Android normally 😛
*Thread Reply:* That's going to be up to iOS to manage. You get this behavior with native email because iOS is smart enough to say "hmm...the password isn't working, let me ask the user." Mobileiron doesn't do it.
Ios would need the same behavior for wireless authentication passwords, so when they expire, the user is prompted.
*Thread Reply:* I expect you mean SIEM. What SIEM software do you use? Generally speaking MI supports Syslog forwarding.
*Thread Reply:* yes SIEM….still early….On a MONDAY 😩
*Thread Reply:* IBM QRadar AFAIK doesn’t have templates for MobileIron. You need to use custom parsing. Except of that it is just simple config in System manager = enable Syslog forwarding + define what should be forwarded. For Sentrys you need to enable Audit log forwarding via CLI.
*Thread Reply:* You can send an APNS message to wake it up, but the app needs to be launched at least once by the user for that to work.
*Thread Reply:* The only way (I am aware of) to launch some app is in single app mode after device restart. Otherwise not possible with any MDM.
*Thread Reply:* If the app supports the URL method, you can call the URL to open the app, but:
- the user has to click on "open" and will be prompted.
- there's no way, AFAIK, that any of the MDM will accept a generic "run this URL" command
*Thread Reply:* Yep, user interaction is needed.
*Thread Reply:* Single App Mode would do the trick (but will lock the device into that app)
*Thread Reply:* And how would you do it with the URL method? API call? Assemble?
*Thread Reply:* The Mobileiron app would need to be set up to process a command to call the URL, which it is not.
*Thread Reply:* As far as I know, there is no way to force an app to open on iOS. We (lookout) have built some tricks with a VPN service we install on the device, but we can't force it to be opened.
*Thread Reply:* This is error is caused by Chrome v73.0. MI have told us that their should be fix coming in a future Mobile@Work client release. Our devices are enrolled as AE Work Profile, so we’re getting users to use the Managed Google Play Store...
*Thread Reply:* arghhhh thanks a lot. unfortunately, it also happens with some Chrome 72 apparently. but the tip is good. the devices with the most issues have Chrome 73.
*Thread Reply:* @Pierre if happened with Chrome 72, please open case with logs!
*Thread Reply:* already done Nico 🙂 of course
*Thread Reply:* device and showtechs
*Thread Reply:* For this customer we are using MobileIron Cloud
*Thread Reply:* Yeah im pretty sure it needs to be reachable. Sounds like you need to create a ticket. I just went in and looked on my test server and my CRL points to https not http. Same if i create a new one.
*Thread Reply:* Ahh ok im talking about on-prem
*Thread Reply:* I think its different on cloud..
*Thread Reply:* So you see https in the CRL, not 8080?
*Thread Reply:* yeah, on services->and then selecting the local ca i created.
*Thread Reply:* Ok.. Me too, only I have 8080 within the URL..
*Thread Reply:* Ok, then im out of answers 😞
*Thread Reply:* Thanks so far, I will raise a ticket with MI.
*Thread Reply:* You should be able to disable port 8080 and force all of those connections to HTTPS. In the system manager, under ports is where you can change that. I'm assuming it would then update the CRL to be available over 443.
*Thread Reply:* There is no option within the System Manager to disable 8080 - I haven’t seen anything like that on Core 10.2
*Thread Reply:* Disabling 8080 has always been an option, it's recommended for production deployments to move those communications to 443.
*Thread Reply:* This is from an older MobileIron install guide, but...
*Thread Reply:* Checking Port Settings The default provisioning port is HTTP/8080. If you have signed certificates, you can select HTTPS/443, instead. To change the port settings:
- Log into the System Manager.
- Go to Settings > Port Settings.
- Select https.
- Click Apply > OK.
- Complete the next steps by going to the following sections.
- See Setting Up Users.
- See Installing Sentry.
- See Configuring Atlas.
- See Restricting Access to Core Components.
- See Rolling Out MobileIron Core.
- Get MobileIron software updates, as necessary. See the System Manager Guide for the specific release for instructions about how to upgrade to the release.
*Thread Reply:* Yes I agree but provisioning is enabled for 443, that is not the point
*Thread Reply:* The point is we have to use a new local CA because the old one is still 8080 which cannot be changed. So re-enroll 12.000 user certs because of that.
*Thread Reply:* Ah, I guess you're right. I hadn't thought about the fact that the CRL is encoded in the certificate. Yep, you may be stuck
*Thread Reply:* Known for reports that need UI access and not only API
*Thread Reply:* You need to work only on assemble scripts that use API only (try to convert those scripts to API v2 in assemble)
*Thread Reply:* uuum ok, i have to check how to proceed.
*Thread Reply:* You mean on the device when the app is installed?
If that’s what you need, look into device based vpp.
*Thread Reply:* Devil is in the details… these comparisons are usually quite misleading. It all depends on the specific use case and I would always recommend to do PoC for any bigger/complex deployment.
*Thread Reply:* What you mean by “weird issues”?
*Thread Reply:* Our last core upgrade completed successfully but the MIFS never went back online. We had to restart Tomcat in order to get it back online. According to support, it was a bug. Our last app sentry upgrade messed up our cloud seviced apps in MobileIron Access. Turns out it that some our ciphers were removed so we had to put them to where they were and made sure they were all prioritized correctly. Just weird issues like that.
*Thread Reply:* Known issue for Samsung devices, the fault is in Samsungs application of GMS.
*Thread Reply:* Do you have a reference for this?
*Thread Reply:* Have you tried “service iptables stop” ?
*Thread Reply:* Login with root access (misupport) and modify the file /mi/config-system/startup_config/systemconfig.xml
*Thread Reply:* Thanks Almar, stopping ipstables worked, tested it on another environment. In this particular case though the changes weren’t Saved, so getting the VM rebooted wiped out the ACLs and we were back to normal.
On the unsupported access, because the firewall rules were in place we could not SSH to the server, even from the VMware console to the local IP. Don’t suppose you know how to get access to the root prompt using the ‘devshell’ command we see MobileIron Support use do you? For future reference :-)
*Thread Reply:* You can request your own DevShell password. See: https://help.mobileiron.com/s/article-detail-page?Id=kA134000000QxoFCAS
*Thread Reply:* I do not know the url scheme but maybe MobileIron FilePass can help (announced for next week, currently iOS only).
*Thread Reply:* @Almar Diehl It is a good news indeed.I have registered for Beta testing.Out of curiosity,can i open an AIP Protected document from docs@work?
*Thread Reply:* Thanks Andrew, you tested that and it works? Nothing in the MI docs about it, but I feel like it did exist :-)
*Thread Reply:* I know that's the syntax, but I can't test it at present.
*Thread Reply:* I was a MobileIron sales engineer for five years, so I've got experience. 😄
Hi everybody🙋♂️, first post here, I hope I can help and collaborate onwards. I need a little help here with the D@W on IOS. I have it working right on AE without any issue. I made it work in the past in other instances of Mi Core+sentry on IOS but last week I installed a new instance on 10.2 and something is not working, or I forget to setup something properly. I add below a few screenshots of my test environment. I installed Documents by ripple(smb client) in an iPad and assign the per APP Tunnel, and it can connect to the CIFs share, so it must be something on the IOS D@W. I tried with CIFSANY and TCPANY non of it makes any different. Comments are welcome. Thanks
*Thread Reply:* Hi Nicolas, I know about CIFS 445, I think I change it during one of my desperate tests. I'll try with 445 again and report back, Thanks
*Thread Reply:* Nicolas, one question, I need to use CIFSANY or TCPANY?
*Thread Reply:* I read in the documentation about IOS that it only works if you use TCP_ANY for the tunnel APP and app connect so because of that my confusion
*Thread Reply:* Tunnel app is TCPANY but Docs@work use embedded AppTunneling (not requiring Tunnel app), for CIFS servers it’s CIFSANY and for WebDAV/sharepoint and others it’s ANY
*Thread Reply:* Ok, I'll try to redo my setup base on that.
*Thread Reply:* And the CIFS connection is finicky. All of the other connections are simply proxying traffic. The CIFS connection is also translating CIFS traffic into Webdav so the mobile device can consume it. It's why CIFS_ANY exists, and why it's mandatory.
*Thread Reply:* Just to check, as you said it does not require Tunnel App, I don't need to add the tunnel app profile on the per app VPN inside the d@W setup, right?
*Thread Reply:* Thanks, it works now, it was the port error. My bad.
*Thread Reply:* I have a customer who do, what’s the question?
*Thread Reply:* did you have to enable activemq manually on MI Core for this to work? Initially we though it was firewall rules but MI just came back that we need to manually enable something on Core 10.2 as well
*Thread Reply:* Complex as we don’t know your use case but anyway I’ll try:
- iOS: support for many advanced functions like VPP device based, DEP with latest profiles
- Android: support for all Android Enterprise use cases like COPE/COBO and many third party integration like KNOX v3 and Zebra support
- General (all OSes): advanced certificate management, security certifications like NIAP / FedRAMP / Common Criteria MDM-PP
*Thread Reply:* Also, agnostic Conditional access and built in Mobile Threat Defense technology
*Thread Reply:* Thanks a lot for your reply
*Thread Reply:* But conditional access is also in intune
*Thread Reply:* We want to connect Android and iOS device to corporate network but the issue is those devices should be domain joined which I feel is complex In mobile device
*Thread Reply:* Another use case is we want to Integrate in-house apps and I know Intune MDM is slight tricky to accomplish this as it requires app wrapping and SDK
*Thread Reply:* Another use case is we want to implement this solution for plant users where issue is about network connectivity and we want to lock down device with in secur environment
*Thread Reply:* Another use case is our majority solution will be for Android , which means we have to make sure MDM should be compatible in all types of Android devices and I know Intune is not good in that
*Thread Reply:* Please help me with some valid points reason why MobileIron or any other MDM but not Intune
*Thread Reply:* But definitely our main focus is MobileIron
*Thread Reply:* I know MobileIron is really awesome
*Thread Reply:* I can only speak in terms of what I tested, before. During the design of our enterprise solution, I evaluate, UEM BES, Airwatch, Intune and Mobileliron core/cloud. It was a year ago, and there are a bast difference in terms of what features are supported at the time, how much intensive in terms of resources they are, and how the technical support works in each solution.
*Thread Reply:* In my case, my target mode to use was AE behind COPE. In this case Mobilieron core was the first solution to release such feature, and it end up being the winner in my evaluation, nut not only because of that.
*Thread Reply:* @System Admin about conditional access with Azure: Microsoft can only perform conditional access through apps that contain the MSFT SDK. No third party apps without SDK can use it (no way to put conditional access on Salesforce, Concur, Service Now, others...) If you have a cloud service it will require app changes to include the SDK which is complex and not ideal situation. Also, native apps like native iOS, Gmail, Chrome & Safari can’t be included in conditional access from MSFT. Only Microsoft apps (Edge, Outlook, Word, Onedrive...)
*Thread Reply:* In terms of supported features, UEM BES and Airwatch supports at the time more AE API calls than mobileiron, but the ones that are not supported by mobileiron are not “critical” in many ways. For example one that is not supported by mobileiron is the one that permits you to set the lockscreen message.
*Thread Reply:* About resources, Airwatch and UEM BES are quite intensive, as they are solutions based on top of windows server, mobileiron is base on linux(centos) and that for me is a point in favour. If you look at the numbers mobileiron core scale up in a very linear way, but BES and Airwatch are madness in terms of the hardware necessities.
*Thread Reply:* I have a customer with 120K devices on 1 core 😄
*Thread Reply:* and they are still going up and up
*Thread Reply:* About Intunes, I discard the solution, at first, because we came from an cloudbase(tenant) Airwatch solution provided by the telco where we CAN’T control which version we are using, and they control when and how the Airwatch is updated. That was totally insane, and I´m sure others have work here with the nefarious VSDM by vodafone.
*Thread Reply:* with Intune you are in the same boat, they update the solution online when they consider is tested and is ready for production environment, even if you are not ready to accept the risk
*Thread Reply:* And this is the same for all the cloud base solutions where you don’t control how they are updated.
*Thread Reply:* I suffer that before and I like to sleep well knowing my UEM is not going to be updated without being able to test the new version in advance, as you can do with the Mobileiron Core anytime.
*Thread Reply:* So in short, Intune does not support all AE APIs, is only cloud based, and even if Microsoft said is “free”(included with your o365 subscription), we’ll see in the future how it evolve, my point of view is that at a point they will fusion SCCM and intune.
*Thread Reply:* Thanks guys , can you please help me with the detailed reason why Intune is not better for in-house apps integration
*Thread Reply:* To test an unmanaged device it doesn't matter. If you've never done this before, make sure you're not doing it in production, as this will change your authentication flow for all of O365.
*Thread Reply:* I usually used onedrive or one of the office apps. Make sure the app in question is managed with the per-app VPN assigned to it, or it won't work.
*Thread Reply:* So I have to enable the VPN config used for Access within the App settings of the App? I only have a production environment. So I am looking for a way with the least impact for existing mobile devices. Since we use Del IdP Desktop devices are not impacted. I think I need to allow unmanaged devices within the Conditional access policy as well otherwise these devices will be impacted since they are not using Tunnel yet - of course within a maintenance window I can block the unmanaged devices
*Thread Reply:* Yes. the way an app is considered "allowed" is if the app is coming in via VPN.
*Thread Reply:* If you're setting up access as a separate IDP that's talking to ADFS, that's fine.
*Thread Reply:* If you change O365, however, I think O 365 only allows a single IDP for the domain. That kind of change impacts all authentication for office. Desktop, mobile, browser, etc.
*Thread Reply:* If it works fine, no issues. Access will pass all the desktop and browser traffic through.
*Thread Reply:* If you have trouble setting it up, though, no one will be able to access O365 until its fixed.
*Thread Reply:* With the Delegated IdP setup I don’t have to modify the Office 365 IdP since there is no trust between Access and Office 365 relevant. Create a federate pair in the Access portal for Del IdP only need the metadata from ADFS. And after that execute the Powershell script from Access on the ADFS. Well with adding the VPN configuration within the app I see a problem - what happens to all the devices which already use that app but not will not have the VPN config because they are not using Tunnel yet. Are they able to use the app without impact?
*Thread Reply:* And also: If I want to use Email+ for iOS which now supports Modern Auth, do I also have to apply the VPN config to Email+?
*Thread Reply:* as long as the policy isn't yet set to block unauthorized apps, they will continue to use it.
*Thread Reply:* You will also see in the access logs how many users are coming in via unauthorized means, so you can be sure that number is acceptable before you block.
*Thread Reply:* Ok got it, thanks. But coming back to the VPN confi which needs to be enabled in the app settings within the AppCatalog. If I enable the VPN config for lets say OneDrive for Business, since this is a global setting it will be applied for all devices. And since we have plenty of devices which will not have a Tunnel configuration hence no Tunnel VPN config applied to them, will the app still be usable for non-Tunnel users?
*Thread Reply:* If they don't have tunnel, the VPN won't work, but that won't break the normal function of the app. Once you set access to block unmanaged apps and devices, however, those devices will break, as those apps will not be "managed" as access sees it.
*Thread Reply:* Clear, thanks! 👍:skintone2:
*Thread Reply:* Regarding Email+: do I have to choose the Identity Cert for Access within the Email+ config and also apply the VPN config within the app? The documentation about this is very limited! 🤕
*Thread Reply:* No. The identity cert in the email+ config is if you're using certificate authentication for email access. That's separate from the certificate authentication needed by Tunnel.
*Thread Reply:* But I have to enable the VPN config in the app catalog for Email+? I am not talking about the KVP for login cert, but the Identity Cert from the dropdown menu
*Thread Reply:* I can not test it at the moment but if I remember this ok there is an option in the Mobile@Work client to re-deploy the shortcut.
*Thread Reply:* Yep, just checked. When you go to Settings in the M@W app there is an option to “Add Apps@Work Shortcut to Home Screen”
*Thread Reply:* Sync discard may have been triggered
*Thread Reply:* note that there is a change in the way CORE calculates the sync discard since 10.1
*Thread Reply:* Before: the percentage was applied to all the users synced in CORE Now: the percentage is applied to each group independently and stops the sync of all LDAP
-> We recommend switching to a number of user instead of percentage
*Thread Reply:* Ah good point. This should be in the logs. Can I disable the Sync Discard without any impact?
*Thread Reply:* Better switch to number of users
*Thread Reply:* depending on your fleet size but a number between 100 & 300 should be enough
*Thread Reply:* Ok but I can temporarily disable it to check if the sync works again, right?
*Thread Reply:* You can, even if switch to number of users will have the same effect, without the risk of having a real user impact in case of sync issues
*Thread Reply:* Bingo, right on the money! Thanks! 👍:skintone2:🍺
*Thread Reply:* If you can open a case to make Sync Discard feature great again it will help 😆
*Thread Reply:* VSP-47816 is the feature that changed the behaviour
*Thread Reply:* This change caused us a bit of grief. We’ve got a ticket open with engineering..
*Thread Reply:* I had that almost 2 years ago: it was and issue in checking CRL & validating the cert chain
*Thread Reply:* workaround was to allow untrusted certs or not checking CRL
*Thread Reply:* it should have been fixed since then anyway...
*Thread Reply:* If it's email+ that's failing, check the domain name it's pointing to using a certificate checker (Qualys has on that's on line)
*Thread Reply:* It will report back any certificate issues, and that may help troubleshoot.
*Thread Reply:* Thanks for your answers. The SSL certificate seems to be good and trusted (SSL Labs rating "A"). I don't understand why the Email+ activation fails... 😞
*Thread Reply:* this is something else 😉 https://activate-emailplus.mobileiron.com/index.php is another resource required for Email+ activation. I also had this one in the past and successfully fixed by playing with key value pairs... but not remembering which ones...
*Thread Reply:* Yes, I read the configuration guide 😉 I tried the key "emailtrustall_certificates", it does not work. I will check the other key-values
*Thread Reply:* Is the device able to reach the URL in the message? That URL (activate-emailplus.mobileiron.com) is required to set up email+. It hasn't even tried connecting to your server yet.
Is the device on LTE or wireless? If you haven't, try LTE. If you have custom VPN enabled, make sure the device has a route out to that URL
*Thread Reply:* @Boris W. did you used AppTunnel rules with Email+?
*Thread Reply:* or maybe per-app vpn with Tunnel?
*Thread Reply:* @Andrew Olpin the screenshot shows 4G 😉
*Thread Reply:* If your Email+ config points to Sentry, test if Sentry can reach the url.
sentry@sentry.acme.com# telnet activate-emailplus.mobileiron.com 443 Trying 107.20.172.67... Connected to activate-emailplus.mobileiron.com. Escape character is 'off'.
*Thread Reply:* The device was connected in LTE. With Safari, the URL is not accessible because of unsecured connection... (same issue on my PC). Nicolas, yes, I configured an AppTunnel Rule with my Sentry in the AppConfig. Thanks Martin for your suggestion, I will test that asap. 😉
*Thread Reply:* did you configured the AppTunnel rule on the Email+ AppConfig because of EWS traffic?
*Thread Reply:* because otherwise you shouldn’t
*Thread Reply:* Email+ connects to Sentry as ActiveSync client
*Thread Reply:* Look at the new “unmanaged device management” added in Access R30. This handles exactly this use case by allowing non managed traffic through del-IDP.
*Thread Reply:* Ok thanks I will.. Is this an option which needs to be enabled? Basically I don‘t want to send desktop traffic to Access. I thought this is the whole point of del iDP, but If a user can still choose Access this will cause a lot of headaches! Not sure if this is designed like that or I missed a configuration step
*Thread Reply:* Nope, you surely missed something. In the ADFS web theme you can select the user agent you send to access. Keep in mind that ADFS will not take the new .js script until you reload it through a specific command in PowerShell
*Thread Reply:* So you are saying I missed something within the execution of the PS script on the ADFS? I followed exactly what is in the guide! The only thing: I did not customize the mobile theme which the powershell prompted me.
*Thread Reply:* I’m talking about the few lines at the bottom of the .js script that you need to add. It’s part of the web page
*Thread Reply:* Not sure what you mean with adding a few lines. Can you point me to it in the guide?
*Thread Reply:* Wow thanks. Is this also relevant for Access as a service because these steps are not in the guide for Access as a service with del IdP I believe . this is the guide with Standalone Sentry..
*Thread Reply:* oh right! true... I’ll reach out the author 😄
That’s because you’re not used to it 😄 It’s just I feel it’s maybe too close to this;
*Thread Reply:* Well... I think he will keep it. https://www.linkedin.com/feed/update/urn:li:activity:6527601001661370368
*Thread Reply:* You two beat me to the joke!
Whats the deal with Core here? Happens after reboot and stuck for a while!
*Thread Reply:* http://vysor.io for USB connected device… or Reflector for wireless connectivity
*Thread Reply:* But that would also mean the the backend destination needs to be externally published for UDP traffic, right? Example if a Cisco Call Manager is only available via Sentry.
*Thread Reply:* Where do I have to configure Split Tunneling for these Video apps which use UDP? In the VPN Tunnel configuration?
*Thread Reply:* Did you create a beta label and assign it to the app?
*Thread Reply:* Yes, we have create a manual label pointing on the beta release
*Thread Reply:* I'd suggest to check the "Pricing & distribution" settings for the app, and also make sure the beta is set to "Open Beta Testing". Also be aware that changes on the Google play console sometimes take a couple of hours.
*Thread Reply:* I've seen the same for AirWatch recently. Perhaps Google changed something ?
*Thread Reply:* @Matt Dermody, any specific features that makes you consider SOTI the best?
*Thread Reply:* Probably should move this out of the mobileiron channel, but i’ll continue for now
*Thread Reply:* native remote control that isnt separately licensed that works for both DA and DO enrolled devices
*Thread Reply:* options to leverage the AE kiosk, custom SOTI launcher, OR Zebra Enterprise Home Screen
*Thread Reply:* multiple methods for accomplishing tasks eg. Packages & File Sync Rules
*Thread Reply:* support for the Zebra MX configuration layer and the SOTI scripting engine is a dream
*Thread Reply:* You can send intents to devices to remotely enable and disable logging utilities
*Thread Reply:* start, kill, relaunch applications, wipe application data, process firmware updates, etc.
*Thread Reply:* And with AEDO + Zebra you can enroll in SOTI with StageNow, bypassing any of the standard Google SUW based methods (NFC, DPC, QR). Zebra provides a bypass barcode that allows you to launch straight into StageNow and then you can scan a second barcode to download the AE agent, install it, set it as DO (yes DO, not PO), and enroll it in an environment. You can use this method to also enroll DO AOSP devices.
*Thread Reply:* Ultimately I think the scripting is the best piece, you can seriously accomplish anything that is not exposed as an available configuration in the UI if you have the scripting layer + mx
*Thread Reply:* If you want to use Zebra Devices, Soti has the most functions right now. If you want to use other devices, I would go for MI.
*Thread Reply:* I believe it depends on the operators in use. Primarily negative operators (for example !=) will affect Core performance. Never really noticed a performance issue, but I also have never seen labels with 70 criteria....
*Thread Reply:* You might want to reconsider and use another method to achieve the same.
*Thread Reply:* Depends on number of devices also. It's a DB query and will be pretty taxiing
*Thread Reply:* Thanks all. In this case, I need to apply a configuration based on an LDAP field indicating the country where the user resides most regularly (as opposed to using the reported location of the device). In this case the world would be broken up into 3 to 5 regions of countries. For example, Label1= if country=Argentina OR Chile OR Paraguay, etc. Label2 = if country=US or Canada. Label 3 = if country= Spain OR Portugal OR France OR Germany, etc. (and 50 more nearby countries). I hear you on the DB query - that's my concern. Assume 40k-70k users per Core.
*Thread Reply:* You could create 70 labels each with own criteria
*Thread Reply:* Interesting. So I'd be trading admin time, admin UI complexity, or potential for admin error for CPU load. Is there good data to support that processing 70 labels is less impactful than processing one label with 70 conditions?
*Thread Reply:* Just from a SQL perspective I'd say that running a simpler query will help the optimizer and your indexes could help deliver fast responses. From an admin perspective I'd almost say that 70 labels would be easier to manager in the long run and perhaps even also initially
*Thread Reply:* And if you ever need to target a specific country you already have that label 🙂
*Thread Reply:* Elasticsearch will deal with the query and also build something like a query plan. Even if the Syntax in the UI is kind of heavy, the overall performance for Value IN (a, b, c) like query will be good. That's nothing complicated for ES.
*Thread Reply:* You can easily monitor this on Core CLI or via Monitoring, by checking the elasticsearch CPU usage. A system of 80k will approx have a elasticsearch CPU usage of roughly 50%, depending on configuration.
*Thread Reply:* Yes, I have, needed it for the beta version of Email+ 3.0
*Thread Reply:* have you some documentation for an implementation easly ?
*Thread Reply:* I have try with Mobileiron documentation but no working
*Thread Reply:* Can you elaborate what is the Cloud token enrollment?
*Thread Reply:* Open the provisioner, you’ll see it under username. It’s also referenced in the update notes in Google Play.
*Thread Reply:* I don’t have an Android device with me 😁
*Thread Reply:* Did you ever find out what it does?
*Thread Reply:* No, my MobileIron resource above there is Android averse :p
*Thread Reply:* Ok ok... I asked around but nobody knew. Should get some info next week.
*Thread Reply:* I know it's cloud related if that helps!
*Thread Reply:* Haha! I’m not an Android averse but my boss didn’t approved yet my expense for it 😬
*Thread Reply:* @Mirko Bülles tell his boss to get on with it. He'll need a mid-top tier Samsung (A or better), Android One/Pixel and possibly a Huawei too (because they go wrong a lot).
Make it so 👏
😁
*Thread Reply:* Tunnel v4.0 coming soon (Q3 release)
*Thread Reply:* Isn’t there a workaround with MS Authenticator, Access URL within the Tunnel Safari Domains, etc?
*Thread Reply:* yes there is with MS Auth, but not ideal as you will allow to connect an unmanaged app
*Thread Reply:* Oh I see, you are right! 🤙
*Thread Reply:* Regarding the allowing unmanaged app - in the KB it is mentioned to disallow unmanaged apps within Access flow.
*Thread Reply:* Yes but the problem is that authentication flow is via a managed app even if the data are in an unmanaged app
*Thread Reply:* Ah yes that is what you mean! Got it
*Thread Reply:* I just heard UDP split tunneling will be delivered Q4. Might be a more conservative roadmap..., but not sure if it will make the Q3 release
*Thread Reply:* Are you kidding me? Ask @Luc we know it works PERFECTLY for 500 devices within few minutes...
*Thread Reply:* I am under the big red umbrella next to the answer desk. Come say hi Kiran
*Thread Reply:* Seriously, did no one else make MI Live? The new logo that bad?
*Thread Reply:* How’s it feel to come to our coast for once @macbentosh? LoL
*Thread Reply:* I'm tired and this city is nuts.
*Thread Reply:* I’m one row in front of you to the right lol
*Thread Reply:* Hey @macbentosh I was there, sorry I missed you. Would have been great to meet you!
*Thread Reply:* Me too - come and visit us at our IronWorks booth! 😀
*Thread Reply:* I want to see a demo of your product...!
*Thread Reply:* The process for renewing the certificates runs at 3:45 AM (UTC), check if that runs OK.
*Thread Reply:* Wow that is some detailed info - thanks!
*Thread Reply:* We have created to Android labels before the migration Android legacy devices Android Enterprise devices
So instead of All Android devices we now use Android Legacy Devices for all config, policies, apps, etc. to be pushed to Android DA devices and Android Enterprise devices for all config, policies, app, etc to be pushed to AE devices.
*Thread Reply:* Just checked MobileIron Cloud. I know for sure that in Cloud you needed a gold license and therefore you could not use it with a silver license. It now shows up there under the silver license so I assume that MobileIron has changed it from gold to silver.
*Thread Reply:* Ah ok well that sounds different. Gotta ask next week in Berlin 😜
*Thread Reply:* Oh good, please do. It’ll make a pleasant change for me not to be the only one asking awkward licensing questions there! 🙂
*Thread Reply:* Anyone from #mobileiron here who can answer this question?
*Thread Reply:* couldn't you always just send down custom xml ? I guess that wouldn't require a specific license?
*Thread Reply:* Technically I guess you are right. But why would we need restrictions within Core if we push down the custom XMLs?
*Thread Reply:* Ability to have 2 entries for the same Android app in apps@work. 1x in-house 1x PlayStore. Especially important during migration to AE.
*Thread Reply:* Thank you for sharing these details 🙂! Very helpful.
*Thread Reply:* If you mean “Resync with LDAP” ,i would say the “Manage users” right, but not sure 100%.
*Thread Reply:* Have a look at Assemble. With Assemble you can export the AppTunnel lists.
*Thread Reply:* Unfortunatly, no assemble in the picture.
*Thread Reply:* If you have delegated IdP setup then you decide on ADFS which auth traffic is forwarded to Access
*Thread Reply:* Right - so I need to configure this separately on the ADFS, not part of the MobileIron IdP Setup Powershell script?
*Thread Reply:* You are right. We do such things (automations based on app install status) via API.
Also relevant here.
}
*Thread Reply:* Is it possible it's trying to download the old MI Cloud specific management app, instead of the new converged one?
*Thread Reply:* Hmm, probably not. The Go client is selected as DPC within the Zero Touch config
*Thread Reply:* Which Tomcat? MIFS or MICS? Did you update the Core? On the console, can you see more error messages? Is MySQL running? I would suggest to contact MobileIron support as it's high priority and intervention on the Linux might be needed....
@Mirko Bülles Devices are Motorola One, nothing really fancy going on with the config. Can’t imagine that being the problem since it does work sometimes.
Hi all, I have an issue when creating web apps on MI Cloud (with Android Enterprise). I upload my icon (png or jpg in 512x512) but the upload fails... I create successfully 15 other web apps yesterday with the same icon and I don't have any issue... Any idea ?
*Thread Reply:* As it's an iFrame to a Google service I don't suppose there's a lot of troubleshooting we can do. Does it accept any other image? If not log it with MI.
*Thread Reply:* I tried other images and it does not work
*Thread Reply:* Solved by the MI Support... They don't make anything... They just do the same process as me and now, it works... 🙄🙄
*Thread Reply:* Ok thanks - It seems with some versions of Core you have to re-enter the password for the ldap user when making changes!
*Thread Reply:* Yes, you have to add the group in the LDAP config in core. Otherwise, Core won't poll that group and it won't function.
*Thread Reply:* what do you mean by single sign in webclip? Like a webclip to an internal app that we have SSO for to auth to that web app or something else?
*Thread Reply:* ah okay my bad, sorry hadn't done that
*Thread Reply:* Hi, I use following URL https://CoreFQDN/api/v2/devices/action?adminDeviceSpaceId=1&actionType=SEND_MESSAGE with POST method. Your data parameter looks fine.
*Thread Reply:* I have made PowerShell class implementing most of the MI’s API calls in Powershell. Here is example of my SendMessageToDevice method:
[Object] SendMessageToDevice([String]$DeviceUUID, [String]$Mode = “pns”, [String]$Subject = “Hello world!“, [String]$Message = “Hello world!“) { $Uri = $this.ApiEndPointV2 + “/devices/action?adminDeviceSpaceId=” + $this.AdminSpaceID + “&actionType=SEND_MESSAGE” $Params = @{ “note” = “Message” “deviceUuids” = @($DeviceUUID) “additionalParameters” = @{ “mode” = $Mode “subject” = $Subject “message” = $Message } } $Response = $this.RestPost($Uri, $Params) return $Response }
[Object] RestPost([String]$Uri, [Hashtable]$Params) { Try { $this.WriteLog(“Debug”, “POST ” + $Uri) $Json = ConvertTo-Json -InputObject $Params $this.WriteLog(“Debug”, “Params: ” + $Json) $Response = Invoke-RestMethod -Headers $this.Headers -Uri $Uri -ContentType “application/json” -Body $Json -Method ‘Post’ } Catch { $this.WriteLog(“Error”, $_.Exception) return $null } return $Response }
*Thread Reply:* Thank you so much for sharing this!
*Thread Reply:* you're defining most of these variables elsewhere in the script right?
*Thread Reply:* PowerShell supports objects since version 5. So I have a class implementing most of the API calls as a methods. So basically I just instantiate a new object using this class (it takes JSON file as a parameter for core FQDN and API credentials). Then I just call individual methods like SendMessageToDevice with parameters. Real world usage then looks like this: . “/path/to/class.ps1” $MIPS = New-Object MIPS -ArgumentList “./config/core_examples.json” $Result = $MIPS.SendMessageToDevice(“91d12427-c730-4b1f-a0a7-44a94ee3c7a6”, “pns”, “Some subject”, “Some message”)
*Thread Reply:* I like the new icons but hate it that they change the icons 🙂 Think of all the manuals/instruction cards that need to be changed around the globe…..
*Thread Reply:* Ah yes sorry my bad. URL pattern would be like tenant.my-sharepoint.com 443, right
*Thread Reply:* The question is do I really need the sentry rules? I don‘t care about sending the Office365 traffic through Sentry, I only want to provide the OneDrive config for the users
*Thread Reply:* If you do not want to route the traffic through Sentry, you should not create a sentry rule. Just add the content site, without the rule and the traffic will not be routed through Sentry.
*Thread Reply:* That is interesting, because we use Kerberos Constrained Delegation on these ActiveSync Sentrys. Can you explain a little more why this won‘t work - because of the missing stickiness?
*Thread Reply:* Cert based Auth requires the session to be alive for more time than regular http sessions. I mean there are multiple connections from the client to the server and it’s mandatory to keep the same server for the entire handshake and session. DNS cannot handle the requirement to keep the same server (A) for 1 session... therefore when the secondary server (B) see the connection it drops it because the handshake was not done with server B but server A
*Thread Reply:* @Dan Hughes, welcome! Just click "start a thread" 🙂
*Thread Reply:* Hi Phil,
if the MS CA is used for other functionality/devices then you really don’t want to overload it.
So my recommendation is:
- Prepare new configs with sha256 certs
- move existing configs to manual labels to keep it on existing devices but do not issue new sha1 certs to newly registered.
- Deliver new configs to newly registered devices via filtered label.
- Use API/Assemble for migration of existing devices in waves.
I did similar migration for 40k devices with exchange/wifi/vpn configs. Just calculate amout of devices per hour/day and then let the script run on scheduled basis.
Feel free to contact me directly if you need help with that.
*Thread Reply:* Be aware that Assemble is slow as hell. That is why I wrote PowerShell class implementing MI API. Using API directly will massively speed up the process.
*Thread Reply:* That’s awesome, thanks Ladislav. Will be in touch if we need help.
New CA should be dedicated to mobile devices, so we can push it the limit.
We’ve got first hand experience on the speed of Assemble 🙄
*Thread Reply:* It is sometimes like 40 mins by Assemble compared to 2 mins with API. Assemble is terribly slow if you need to retrieve data for huge amount of devices.
*Thread Reply:* During the last migration we did the crucial parts of the migration were: 1. progress monitoring, 2. user notifications - we sent email/push notification to every user 1 day before migration.
*Thread Reply:* Last hint: do not underestimate additional load on Sentrys and EAS backend. Exchange config re-push = email re-sync on devices. From user experience it means all contact/mails/calendar entries will dissapear.
*Thread Reply:* MobileIron will release a tool to migrate users without re-enrollment. But it is not available yet. You can hire professional services to do the same: they will set up the tool and help migrate the users. You will need to configure the Cloud and configs still.
*Thread Reply:* Oooh so I can still obtain that tool, I'm just responsible for configuring it?
*Thread Reply:* No not yet. Only PS have access to it for now
*Thread Reply:* Gotcha - magic question - any idea when that tool will be released for general use?
*Thread Reply:* I really have no idea about that. If you have an account or partner manager, you might want to ask them.
*Thread Reply:* My old contacts @ MobileIron said the tool was pretty much there. Reach out to your MI account team for help.
*Thread Reply:* The “LUI migration tool” is almost there... some fine tuning to make is usable by trained partners I guess and we’re here. LUI stands for “Low User Impact” 😉 I’m currently working with a very large customer (150k+ devices on Core) to migrate to Cloud with this tool.
It works frictionless for iOS and Android DA. For AE Android devices we need to find the right way to do that: either through the API available in P or through another magic thing we will do inside our client app
*Thread Reply:* @NicolasR is the tool only for migration from MI On-Prem to Cloud or also for other scenarios? On-Prem to On-Prem, Cloud to Cloud, different EMM to MI?
*Thread Reply:* Only CORE to CLOUD (soon we will support Connected Cloud to CLOUD)
*Thread Reply:* @Justin Butts Although the Core > MIC LUI is "ready", PS is still working out some minor tweaks in it. The CC > MIC will not be available until Q3 (most likely, end of Q3). There are definetely caveats you should be aware of with using LUI. Most important is that the Apple MDM needs to be imprted into the Cloud first, not in arrears to prevent the iOS chain from being broken. A series of CLI commands on the Core can get that extracted for import into the Cloud. One of the challenges with the CC migration! There are other options available to migrate to and from UEM platforms. DM me if you need to discuss. Good luck!
*Thread Reply:* Yes works fine. Basically there is no connection between KME and Core (as you would have with DEP). You configure KME and there you configure the MDM to connect to. 30 minutes work.
*Thread Reply:* Nice, thank you for confirming Mark 🙂! Looking forward to see how this looks.
*Thread Reply:* For iOS I would recommend using VPP to purchase and push Books (iBooks) to your users, you would retain ownership of the book and would also manage distribution of the content. So you can publish the books to the user to choose to read
*Thread Reply:* Is that more of what you are looking for?
*Thread Reply:* From my knowledge there is no way to push apps from public App Store, you would essentially purchase books via VPP and publish to the books app to create your own "bookstore" so to speak. Problem there is you have to purchase all the books users can't just choose. So I would recommend having your users ask which content they want to give you some materials to bring to the books app
*Thread Reply:* If outlook supports XML config, and you’ve another means for pushing it to the device, probably.
*Thread Reply:* I think this is not possible in this setup. But you can do it with Android Enterprise.
*Thread Reply:* Ok thanks. Does anyone know if Outlook for iOS or Android Enterprise can be used with Lotus Notes and KCD?
*Thread Reply:* maybe it works but it is not officially supported, so I wouldn't do it
*Thread Reply:* The definition file is uploaded in Google Play at the same place where you can upload an app. But before being able to upload the definition file you have to enable Managed Google Play for the app and select the checkbox just above the APK/definition upload frame.
*Thread Reply:* Upgrade to Core 10.3 which will make Inhouse app deployment much easier!
*Thread Reply:* Not easier for self-hosted applications. These still go through the cumbersome Google Play process.
*Thread Reply:* I thought the virtual private Google Play Store is a part of 10.3? 😳
*Thread Reply:* Thanks @Almar Diehl these were the steps I was missing Go to Pricing & Distribution > User programs > Managed Google Play. Check the Turn on advanced managed Google Play features box. Check the Privately target this app to a list of organizations box. Click Choose Organizations.
*Thread Reply:* Yes @MichaelM21 it is but you can only use it for APKs. If you want to host the APK on you own server and want to upload a definition file to Google Play Store you can not use the Google Play iFrame.
*Thread Reply:* Ok that means I can upload an APK to Core in distribute it directly to the device without publishing the app in Google Play before?
*Thread Reply:* No, you always have to publish. Either an APK, using the iFrame, or a definition file using Google Play Console.
*Thread Reply:* You can push APKs to devices from Core, but they won’t show up in Google play, they’ll install silently.. they’ll also be subject to less than ideal caveats, so Play is the better route
*Thread Reply:* So basically what you are saying is that Core 10.3 is possible to deploy an APK directly to the device. With this private virtual Google Play Store integration without the need of a developer account?
*Thread Reply:* $NULL$ and in the field at the right just enter your key 😉
*Thread Reply:* Ok, you really do not need to use a variable, but you can replace $PASSWORD$ with $NULL$ indeed, assuming you need users to authenticate with accounts. If users authenticate with a client cert, you can leave it as is.
*Thread Reply:* They don‘t authenticate with an account, there is only a PSK which the user don’t know
*Thread Reply:* WPA 2 Enterprise does not use a PSK. The “enterprise” part means you will have a radius server for authentication. So I am not sure what you are trying to do now…
*Thread Reply:* Sorry for the misunderstanding - obviously I am not a golfer as The Big Lebowski would say! 🙈
*Thread Reply:* it depends on:
- Your Access setup (is it Delegated IDP or IDP Proxy)
- If you have a separate Service Provider
*Thread Reply:* In short if you deployed Access in IdP proxy mode then yes.
*Thread Reply:* @NicolasR It is deployed as IDP Proxy.We don’t have a separate SP.Will that work in this scenario?
*Thread Reply:* No, because the federated pair is linked to the Service Provider
*Thread Reply:* We currently have aADFS-Office 365 federated pair configured on Access tenant.Our live MI core is registered to core.We would like to register our test core as well so that test users can also leverages the functions of access for the same AdFS - SP federation.
*Thread Reply:* it will require another O365 tenant at least
*Thread Reply:* if O365 supports multiple Identity providers, maybe you can create another Relying party on the ADFS
*Thread Reply:* Today i got a confirmation from Mobileiron support that says we can register up-to 6 cores on an access tenant and can use same Federated pair.Let me test that tomorrow and see how it goes.
*Thread Reply:* You are not allowed to install any third party software unless MobileIron support or PS advise you. :malepoliceofficer::skintone2:😉
*Thread Reply:* What’s the need? Deploy anti virus or equivalent?
*Thread Reply:* Go to System Manager, enable debug logging, click MIFS link to see realtime logs, repeat test in certificate enrollment profile.
*Thread Reply:* Thanks for the fast response.. I will look for it!
*Thread Reply:* 2) not really. Its changing too fast. you can compare features in the Roadmap if you have access to it.
*Thread Reply:* 1. Are you on Core or Cloud? At least for Cloud, you can use Azure AD as the user and admin source. You can set up MFA for admin accounts on Azure AD which have access to the Cloud portal.
*Thread Reply:* 2. I have requested such a list many times, but never got it. Assume it is cumbersome as there are many changes between the two. But please request it with your account manager or MI partner, maybe it gets heard.
*Thread Reply:* I was a sales engineer at MobileIron, and despite how often we asked, we never got a comparison sheet either. 🙂
Part of it was the monthly MI Cloud releases made it hard to keep up.
*Thread Reply:* 1) You can federate with your IdP for enrollment authentication/user/admin portal access. Except to that MI Cloud AFAIK supports 2FA via email.
*Thread Reply:* 2) Functional wise MI cloud and Core are comparable now with new features being prioritized on Cloud. Especially in case of desktop management (W10/macOS).
*Thread Reply:* Except for APIs, which are wildly different between the two, of course. However, I presume you’re considering which would suit your current or future requirements best?
*Thread Reply:* To be honest, I think it is a messy between Core and Cloud. Some features you expect in Cloud (by nature) come to Core first and vice versa. Working on both is sometimes confusing because you tend to think all features are available on both and you assume it is available.
*Thread Reply:* Hi Ignc, in 1 of the Sentry configurations in Core you need to have the F5 domain (sentry.whatever.com) configured for the Sentry hostname. In the system manager of Core, create a static host record pointing sentry.whatever.com to the ip-address of sentry1.whatever.com.
*Thread Reply:* HI Almar, thanks for your reply, I imagine something like that can be done, but I supposed that a more “elegant” option should be available. It looks more like a workaround than a “clean” solution, because of that I asked 😂. Anyway if it work I can live with that 😁.
*Thread Reply:* We use the same configuration as @Almar Diehl mentioned. Network load balancer alias is used as sentry name for first node in Admin portal. For all other nodes in the Sentry pool we then add incremental number. So if the NLB alias is sentry.acme.com then the first sentry name is sentry.acme.com, second sentry is sentry2.acme.com, third sentry3… Static host record on Core side will then point sentry.acme.com to first Sentry node instead of NLB.
*Thread Reply:* Yes, in favor of AE dedicated device Kiosk mode
*Thread Reply:* And customers who still use Knox Kiosk have to move to AE COSU?
*Thread Reply:* @Woody that is correct. You can also do this if an Admin request a PIN manually. The limitation is enforced on the BYOD portal which is used by users to request PINs for registering devices.
*Thread Reply:* Thanks @Adrian Patrascu! I’d love to find a way to keep this limitation enforced, but exclude DEP enrollments from being subject to it.
*Thread Reply:* I suppose Core cannot differentiate between what is a DEP-Based enrollment and BYOD enrollment from a generic MDM Request Level
*Thread Reply:* Have you tried URL encoded address?
*Thread Reply:* How do you mean? Which one is that?
*Thread Reply:* Basically you have URL in your Docs@work config, right? Something like: https://sentryfqdn:445/share/. If you have space in share name then try to use %20 instead of space - something like https://sentryfqdn:445/some%20share/
*Thread Reply:* Gotcha, I will try it! Thank you!
*Thread Reply:* Of course there is impact. You are now using Passthrough authentication. This will be disabled and connections will require Cert based auth.
*Thread Reply:* You need to specify a SCEP config in the Exchange config
*Thread Reply:* It will be pushed to all devices: all current mail, contacts and calendar info will be removed. Until the config is updated on the device, the connection to the Sentry will fail
*Thread Reply:* That would not be needed. It only needs the public key
*Thread Reply:* That is what I said, but we receive that on the Radius:
*Thread Reply:* Don’t ever share PK of your Root CA to any other system. In the system log I see “….SSL server credential’s certificate…” so I would check radius server cert first.
*Thread Reply:* @Ladislav Blazek I have read RFC 5216 - The EAP-TLS Authentication Protocol. [...]With EAP-TLS, both the client and the server must be assigned a digital certificate signed by a Certificate Authority (CA) that they both trust. The certification authority (CA) that issues the user certificate must also be the CA that issued the server certificate to your NPS server.[...]
That would mean that Core local CA needs to issue a certificate for server authentication with a private key for the NPS. Is that even possible? Issue a certificate with a custom SCEP?
*Thread Reply:* @MichaelM21 “With EAP-TLS, both the client and the server must be assigned a digital certificate signed by a Certificate Authority (CA) that they both trust.“….. This is true. But I don’t think client and server certs must be signed by the same CA.
*Thread Reply:* Basically on MI side you need to edit your WiFi profile and:
- add radius server name to “Trusted Certificate Names” field
- or add CA cert which was used for signing radius server cert to MobileIron and select it “Apply to Certificates” field.
By this you ensure that client will trusts server.
*Thread Reply:* On the server side you need to ensure that server will trust client certs = you need to import MI Core CA cert to Trusted Root CA store
*Thread Reply:* As of Core 10.3 you can configure what the minimum Android version must be for registration of a device. And also the minimum security patch level. Moreover you can create a white- or blacklist of Manufacturers.
Nothing of this all for iOS….
*Thread Reply:* Hi @Woody , Thanks for letting us know this information. Really helpful! Do you have an article to which we can point out? Also is this happening with a particular Core version?
*Thread Reply:* Hi, I do not believe that the MDM protocol allows for this option. You would need access to something like Screen Time or something similar to which Apple does not allow access. You can know if the app is installed or not, and what version it is running. If you want any details on how often someone access a particular service maybe you should focus on gathering statistics from that particular service, via access loging or something similar. You can use user agent to identify mobile access.
*Thread Reply:* If the App uses Tunnel/Appconnect you could check logs how often it triggered.
*Thread Reply:* MobileIron has a webclip called multi user secure sign in that lets you swap the user assigned to the device. It can uninstall / reinstall apps when the sign in occurs.
Keep in mind that this functionality is based on the MI assignments, and may have stuff left behind like Safari passwords, or signed in web sites.
*Thread Reply:* Hi macbentosh, we do several things before we upgrade a MI Core appliance which might be helpful for this scenario as well.
- Perform a snapshot of the VM it is hosted on
- Create a backup of MI Core and uploaded it to a safe location, just in case things do not work out as expected
- Block network traffic to Core by running a lockdown script
*Thread Reply:* I would recommend a snapshot of it and perform a clean shutdown of the vms before data center.
*Thread Reply:* is there a good shutdown command>
*Thread Reply:* Hi @MichaelM21 are these apps you mention VPP, in-house or Public Apps? Note that the automatic update does not work silently on all type apps. Also the process is a little bit different on Supervised and Un-Supervised devices. If the app is not managed, then the settings are not enforced via MDM.
*Thread Reply:* Hi.. Mobile@Work VPP apps but some devices are still not enrolled as DEP devices, so I can imagine the conversion from unmanaged to managed was not excepted! Can this be checked if the app is managed or unmanaged? Devices are supervised and unsupervised.
*Thread Reply:* Yes, from what I know Core has an option to do that. The way I do it is select the app, then click on the number of installations, export as csv. In the csv file there is a column with the Managed attribute. I hope this helps.
*Thread Reply:* You can also chose the option to allow and enforce the app to be managed. Ensure you have the VPP license to be device and not user based as well
*Thread Reply:* If it’s not supervised it will nag them I think at every device check in
*Thread Reply:* Hi @MichaelM21 I received a question from someone today and remembered your post here. Was there any incentive for you to enable this option? I can see we also have many users that are not running the latest 11.1.0 app, that has been release almost 2 months ago. Do you have any concerns with people roaming? As the app is 75MB large.
*Thread Reply:* Hi Michael, according to this documentation: https://help.mobileiron.com/s/article-detail-page?Id=kA134000000QxHZCA0 what you are seeing is not a normal behavior. This should not apply to iOS System apps like the Phone or Messages.
*Thread Reply:* Thats what I thought. Thanks..
*Thread Reply:* Hi Michael, if you have just Samsung Android tablets, maybe you can do it based on model like this: "common.model" starts with "SM-T" and for other manufactures see if there is a pattern in model that would help.
*Thread Reply:* Not a link or copy, but I would try the following:
*Thread Reply:* 1. Create a single file (pem for example) containing all the Radius server, intermediates and root certs. Add it as a Certificate Config.
- Reference that in the Wi-Fi config
- Type the FQDN of the Radius server in the Trusted Certificate Names field of the WiFi config.
- Push the Certificate Config (1) to the device
- Push the WiFi config
*Thread Reply:* Not sure if it will work, sometimes you need something to get it to work
*Thread Reply:* @Woody - this one? https://community.mobileiron.com/docs/DOC-1934
*Thread Reply:* @MichaelM21 - Yeah! Thank you so much for finding that
The new Gartner UEM Quadrant was published. MobileIron way behind (SOTI dropped) - share your thoughts on that. Not sure if Gartner is still a serious and impartial source.. 😳🤔 I can already hear customers bashing about this.
*Thread Reply:* Why do you understand MobileIron dropping? Just curious..
*Thread Reply:* Product management has been lacking to introduce a lot of new features and product sets. It’s been really slow for about 1.5 years
*Thread Reply:* Citrix and MS are high up on the back of their legacy tools, which make up for their weakness in the mobility space. They’ve dropped from where they were on the old quadrant on the back of the gaps in that space.
*Thread Reply:* MobileIron hasn't put the focus they need to on Windows. Also, a bunch of customers are jumping to intune. I think these are really the only two reasons.
*Thread Reply:* Do you really think that if Mobileiron was the best tool to manage Windows 10 a lot of companies would do it with MI?.... I’m not sure. MI is small against MSFT, competing on others platforms is already a challenge, competing with MSFT on Windows is suicide. The new strategy to change the focus to a security company is more realistic Because instead of being in competition Mobileiron will start more and more being a partner of MSFT!
*Thread Reply:* Maybe yes, maybe no. I do know a very large MI customer is jumping ship to VMware because they really want to have a single environment to manage all of their endpoints, and VMware does a better job with windows.
And, whether or not you think a company would move, the point is Mobileiron's position in the MQ. The MQ is "unified endpoint management" and Mobileiron is trying more to me "Enterprise mobility management + security", which is they the UEM MQ hasn't treated them well.
*Thread Reply:* Ya Intune is developing fast and as intune is availble for the majority of companies who already starting their transition. Blackberry and MI will stay as strong lead as well till features of both world will be implemented in Intune. But from my point of view intune and MI or Blackberry are not equal so its not clear why MS is so high.
*Thread Reply:* Agree entirely. VMW has become the most complete offering out there. Sure, it has caveats.. but holistically.. no other on the market is moving at the pace they are.
*Thread Reply:* MobileIron is still solid, they just aren’t innovating at the rate they used to. I understand a drop, but that is pretty drastic.
*Thread Reply:* MobileIron is already celebrating... 😳🙈
*Thread Reply:* Yeah - I saw that as well. As a former employee, I want what’s best for them… but they really need to light a flame under their arse and get back at it
*Thread Reply:* Multiple known issues regarding attachments. Check the iOS 13 guidance: https://help.mobileiron.com/s/article-detail-page?Id=kA12T000000fyP2SAI
*Thread Reply:* You asked the same question on July 2nd…
*Thread Reply:* If the shares are “published site” they will be read only, uncheck the check box to have this capability
*Thread Reply:* also there are KVP allowing to block doc upload
*Thread Reply:* Have you tested the M@W 10.4 beta?
*Thread Reply:* Hi Almar, not yet. I have asked for this beta version and will test it once I receive. I expect this to work with M@W 10.4 beta. I will keep you posted once I receive it and check it out.
*Thread Reply:* You can test the beta version by opening the PlayStore, select the M@W app and click the option that you want to become a beta tester for this app. After doing this you can upgrade the app to the beta version.
*Thread Reply:* It works, although I still see the app crashing, after a few seconds it automatically re-launches the process from where it left off. I believe there are still a few tweeks to be made here, but it works 🙂! Thank you Almar for sharing this information very helpful!
*Thread Reply:* If I remember correctly you will need to push the Email+ client to the device(s) again since the certificate is part of the configuration.
*Thread Reply:* Almar 007 strikes again.. thanks! 👍:skintone2:
*Thread Reply:* Curious how you’re going about removing the user cert so the UPN gets updated? I’m finding that in a similar situation using KCD where the UPN is changed in ADLDS, iOS SCEPs automatically refresh, but SCEPs inside a Knox container do not. I’ve been looking for a way to trigger the refresh of that SCEP, or worst case, somehow script the deletion of the user cert so that it will refresh at next device check-in.
*Thread Reply:* @Nick you can remove the cert via Core Admin Portal (Certificate Management tab) and an new cert gets issued and deployed to the device automatically
*Thread Reply:* Agreed, @MichaelM21, and that's a worst case fallback. But in my particular case, the UPN of tens of thousands of users is changed on a rolling basis.
*Thread Reply:* Oh in that case I agree, thats no option for you 🤮 Any possibilities with Assemble?
*Thread Reply:* Tunnel v3.x doesn’t support UDP packets Tunnel v4.x currently beta, soon release will support split UDP so your Jabber server must allow UDP from internet
*Thread Reply:* Ah yes, we talked about that. Thanks for reminding me. 👍:skintone2:🍻
*Thread Reply:* Can we use Access As A Service with PingFederate as Delegated IdP though or is there a drawback?
*Thread Reply:* @MichaelM21 I am also looking for some guidance for deploying SSO for jabber via access.Are you using jabber MRA deployment?
*Thread Reply:* @mahiroux yes, we also use an expressway. Our users have only smartcards so they don’t know any passwords. We are looking into cert based or SAML
*Thread Reply:* @MichaelM21 Did you manage to deploy SSO for jabber MRA?
*Thread Reply:* Unfortunately we didn’t start yet. How about you? I have read on another thread here that it is not clear that Cisco supports Tunnel at all.. @NicolasR do you guys have any customers with Jabber and Tunnel?
*Thread Reply:* @Michael Not yet.As per our corporate policy,we had to make sure all the calls are recorded.We have achieved this very recently with our existing recording solution.Now the management has given the green signal to go ahead with production deployment.Do you prefer SSO over CBA?
*Thread Reply:* @NicolasR do you have any documents how to configure the delegated IdP Pair in the Access Admin Portal for Ping and Cisco Jabber SSO? I have the document for O365/PingFederate, but not sure how to setup the same for Jabber..
*Thread Reply:* Ask your OEM to support it with OEMConfig, it's not an AE API
*Thread Reply:* Fortunately it is for Samsung devices so ksp can be used but mostlikely extra license is needed
*Thread Reply:* I wouldn't immediately assume so. There's a mix of both free and licensed in KSP
*Thread Reply:* For the apps@work icon we have the same issue on CLOUD R64. Fixed in R64.3
*Thread Reply:* I can confirm 2 and 3.
*Thread Reply:* it will be fixed in 10.4.1
*Thread Reply:* Anyone have an ETA for release?
@here Trying to remember - If I check the AE box, will the app also remain available for legacy devices running Device Administrator?
*Thread Reply:* Thanks @MichaelM21! I tested it with a new app and observed the same (while waiting for a response).
*Thread Reply:* I am not aware of any differences between iOS and iPadOS in regards to MDM api/functionality. So it is still pretty much iOS. Everything works fine on my iPad with iPadOS 13.1 beta.
*Thread Reply:* Great, good to know! Thanks Ladislav!
*Thread Reply:* @Ladislav Blazek Have you noticed any issues ‘open in’ attachments with managed apps.I am not able to open attachments from mail apps with managed apps.Open in function works the moment i remove mobileiron from device.
*Thread Reply:* @mahiroux Will check. What are your managed open-in settings in Restrictions config?
*Thread Reply:* Both managed to unmanaged and unmanaged to managed unselected.
*Thread Reply:* In our prod environment,unmanaged to manage is enabled,however same issue is noticed.
*Thread Reply:* There will be no zero day support for some new features. F.i. user enrollment will be supported in a Core upgrade planned for the end of the year (according to MobileIron).
*Thread Reply:* @Almar Diehl yes, I hope that MI will implement (at least some) new features fast. WMware already announced support for some new features like selective sync of Mail/Calendar/Contacts in Exchange payload in WSO UEM version 1908
*Thread Reply:* @mahiroux Do you see managed apps in Share dialog or not?
*Thread Reply:* I am testing now managed open-in functionality on my iPad running iPadOS 13.1 beta (currently enrolled in WSO). I see the managed apps in share dialog but when I tap the app to open document nothing happens. Looks like it is seriously broken in iOS/iPadOS 13.?… Anyone else can confirm? #ios_betas
*Thread Reply:* I can see them however it doesn’t open attachments. When i enable select both restriction configs,Managed to Unmanaged and Unmanaged to Manage,open in is working however that breaks our DLP controls.
*Thread Reply:* @mahiroux of course. I see the same behaviour on my device managed by WMware WSO. What is the iOS version you are testing on? 13.1 or 13.0 beta?
*Thread Reply:* I have been testing this for Beta 6 to 13.1 with the same result.
*Thread Reply:* I have not noticed this bug in previous betas…. good finding. Thanks!
*Thread Reply:* I see similar on my iOS 13 Beta6 not able to open attachments in a managed app, but I remember I was able to do this in the past. Has something maybe changed in this new Beta 6?
*Thread Reply:* Don’t know… I just submitted issue via Feedback Assistant to Apple. FB7153828
*Thread Reply:* @Ladislav Blazek “selective sync of Mail/Calendar/Contacts in Exchange payload” - I think I’ve been waiting on this for half a decade. Nice to see it finally coming to life!
*Thread Reply:* @Woody yeah, finally solution for customers using Email+/Boxer on iOS and struggling with contact sync.
*Thread Reply:* @Ladislav Blazek this is what you were referring to, right?
*Thread Reply:* This would have been super useful back when we were pushing calendars to Administrative Assistants
*Thread Reply:* @Jonathan Henson @japple In case you guys are still doing some of that ^^^
*Thread Reply:* Yes, exactly, calendar only is another use case.
*Thread Reply:* It’s like this since the first release of iOS 13 beta.
*Thread Reply:* By the way iOS 13.0 will require one of these:
- Core 10.2.0.2
- Core 10.3.0.2
- Core 10.4.0.1 Silent APNs and iOS pin registration issues
*Thread Reply:* Awesome Thread!!👍:skintone2:
Anyone familiar with the ErrorCode 12040 for Install Managed Application on MobileIron Core? We use Apple VPP (Device License is used), but sometimes users get promptes for an Apple-ID. In this case for Mobile@Work or Docs@Work.. Only some apps with certain devices have this issue.. UPDATE: damn, sounds like this: https://help.mobileiron.com/s/feed/0D53400004dlVD1CAM
Is there any impact for existing devices if I revoke all licenses?
*Thread Reply:* Very good question. I am also interested in this, but I haven’t started the implementation yet.
*Thread Reply:* Haven't done it yet, but Tunnel uses the native Android Enterprise VPN, or? Which certificate are you asked to trust? Sentry or jabber server? Is Jabber UDP or TCP?
*Thread Reply:* Hi Wolfgang, it is askings to trust the SSL certificate of the Jabber server. But your question about UDP or TCP triggered me. I think Jabber by default connects over TCP port 5222 for XMPP.
*Thread Reply:* https://ccieme.wordpress.com/2017/01/23/cisco-jabber-port-usage/
*Thread Reply:* is the certificate from the Jabber server an internal one? maybe trust the CA on device side.
*Thread Reply:* Well yeah, seems to be a firewall issue. Trying to get this solved.
*Thread Reply:* So all UDP relevant traffic must be reachable from the internet before Tunnel 4.0 hits.. Was that task clear how to publish all relevant UDP services?
*Thread Reply:* 10.3.0.2 is already available with the compatibility support for iOS 13 devices, in case you have not migrated to 10.4.0.0 already
*Thread Reply:* Good point thanks. But I believe the publishing of private apps for Android Enterprise without a developer account is only available from 10.4. I don‘t see the iFrame integration with 10.3.0.0
*Thread Reply:* @NicolasR what is coming out on 9/4?
*Thread Reply:* We've been holding on 10.4 due to a few bugs we found
*Thread Reply:* Awesome, what's fixed in it? 😄
*Thread Reply:* Mostly iOS/iPadOS 13 stuff, but also the issue that occurred with 10.4.0.0 and sentry sync
*Thread Reply:* 10.4.0.1 is available - safe to install?
*Thread Reply:* Do they, the other admins, have a device registered?
*Thread Reply:* Events only work for users/admins with a registered device… (was dumb 5 years ago, still so unfortunately. Admins do not have a registered device normally)
*Thread Reply:* As Mark says, very annoying. As a workaround I just create a device registration for the admin but don't actually configure a device, just leave it pending.
*Thread Reply:* What, really? No, no admin has devices, even not the one who can be chosen. But I remember we had a thread in here where someone explained that events work with local user where the email address of that local user can be a distribution list. That local user has no device and I am 95% sure that events are getting delivered. I gotta find the thread.
*Thread Reply:* This workaround is no more actual for years now!! Look if the admin exists on the users list if not, import them here
*Thread Reply:* @NicolasR in the event you mean? Why would they not appear in the admin area if they are admins?
*Thread Reply:* Admins are user objects with admin permissions
*Thread Reply:* So regular admin should be in users list
*Thread Reply:* @NicolasR I am not sure what you mean. But in any case: for System events, you can only select “admins” when they have a device registered or a device registration. Admins without a device or registration will not be shown regardless
*Thread Reply:* If I look under Devices & Users / Users they don’t show up under Authorized Users.. most probably because they have not logged on yet (they are ldap accounts).. I can search for the via LDAP entities. @Mark Vonk the one which can be chosen has also no device registered and I can select him
*Thread Reply:* Admin here looks for any user in the database. Not only users with admin permissions
*Thread Reply:* But not sure how I can solve it..
*Thread Reply:* Add them manually in the authorized entities list
*Thread Reply:* I can only add local users there
*Thread Reply:* No, you can add users but UX sucks...
*Thread Reply:* 😂😂 I see no button for this
*Thread Reply:* Ok. so I have a local user. It is shown in the authorized user list, but I can’t select it. It does not have a device or device registration. Identical user, in authorized, with a device: can add it to the Event admins
*Thread Reply:* @NicolasR and how should I add it then? Via CLI?
*Thread Reply:* Nope, select the drop down LDAP entities
*Thread Reply:* Search for them and add them user portal role
*Thread Reply:* @Mark Vonk same here. I have created a local user, and I can select the local user in the event. What core version are you on? 10.3.0.0 here
*Thread Reply:* As soon you do this they will show in the authorized entities
*Thread Reply:* That user has user portal already
*Thread Reply:* You can use the account to log on once (for ex. on the Admin portal) and it will show up under authorized users. But I am still not sure this solves it. As said before, I can’t search for and/or select any account without a device registration or device. I am on 10.4
*Thread Reply:* My local user has also never logged on and still shows up as authorized. Giving up for today
*Thread Reply:* @Mark Vonk did you selected sms or push as delivery method to admins?
*Thread Reply:* No, but changed it. No diifference. Can search for and select user1 (has a device). User2 (without device) can’t be found or selected
*Thread Reply:* @NicolasR I have the same setup and this also works for me. But not for the ldap admins
*Thread Reply:* both user1 and user2 are local users for me
*Thread Reply:* Identical users except for the UserID. And user1 has a device
*Thread Reply:* Also did a short test.. local user with distribution list email added to a system event. Shut down Sentry. Under Logs/Events I see Sentry not reachable - status dispatched.. can’t check at the moment if it was really delivered
*Thread Reply:* Yeah… and since that time we are fighting with constant notifications in M@W with message “Device in compliance”. Already created ticket on MI support portal.
*Thread Reply:* Ok i will open a new ticket to enforce your case
*Thread Reply:* Do you see the same issue @Luc
*Thread Reply:* it s happen on android 9 and 10 other i d’ont know and in mode COPE and BYOD
*Thread Reply:* @NicolasR What you mean by “Android 10 it’s as per design”? Users are getting that message like every 2-3 mins…
*Thread Reply:* @Ladislav Blazek https://help.mobileiron.com/s/article-detail-page?Id=kA12T000000TOVUSA4 “MobileIron Clients (Mobile@Work & Go) will not be auto launched after Android Enterprise profile is setup due to changes in behavior in Android 10. The user will be informed through a notification, and the user will need to restart the profile app from the launcher icon or through the notification.”
*Thread Reply:* Thanks @NicolasR. My issue is right now on Android 9. Users are bombarded by notification every 2-3 mins, M@W is running. Not able to verify behaviour on Android 10… but as far I understand this should happen only in case M@W is killed/not started, right?
*Thread Reply:* We had that with SAM 8.5... probably the same issue
*Thread Reply:* You’re not the only one @Ladislav Blazek A customer reports it also
*Thread Reply:* hi ladislav could you give me your case number to refer it
*Thread Reply:* i will refer your case also in my case
*Thread Reply:* so i hear that it will fix in next version mobile@work in 10.4.0.1
*Thread Reply:* any idae when it will be deploy on google play
*Thread Reply:* next week the version 10.4.0.1 beta will be deployed, and normally this version will fix this issue i will give you some feedback when i have tested
*Thread Reply:* Never seen this issue in the wild anywhere. Might be that some Core had it, but issue did not present itself in a bad way.
*Thread Reply:* 10.3 creates new iOS MDM configurations for all registered iOS devices and pushes those to the devices. The behaviour you are seeing might be a result of this.
*Thread Reply:* 10.4.0.1 was released today. installed this morning, confirming so far that it resolves the custom app branding issue for apps@work and the sentry to core disconnect issue.
*Thread Reply:* What makes you say Intune is out for AE?
*Thread Reply:* COBO still in preview after how many month/years... no COPE in sight! Only COSU with no user affinity.. So what DO do you pick? no way to enable system apps via Intune. No MX support for Zebra Devices via DA.. And while we are at it - no E-FOTA!
*Thread Reply:* I’m not as familiar with the limitations as you are. Just trying to understand the difference from what both Google and Microsoft are saying when calling Intune “AE Ready” (https://androidenterprisepartners.withgoogle.com/provider/#!/75 ) and the reality. Acknowledged that many use cases aren’t viable.
*Thread Reply:* I have a pretty long list what doesn’t work with Intune. I will share it once I finished it! 😊
*Thread Reply:* Before I dive into the weekend I’d like to share this one (again) because it always makes me laugh and cry at the same time - I will never understand this action of a non-compliant device: 😂😂🙈🙈
*Thread Reply:* You'll notice the only other vendor with a ** is Google itself.
*Thread Reply:* MobileIron: It is not a requirement to upgrade. In Sentry 9.7.2 what changes is the self-signed certificate format, and Sentry 9.7.2 will generate compatible certificates with iOS 13 and macOS 10.15. As long as the existing certificates on Sentry meet the requirement from this KB, there is no need to upgrade Sentry: https://help.mobileiron.com/s/article-detail-page?urlname=iOS-13-macOS-10-15-Requirements-for-SSL-certificate-trust
*Thread Reply:* Thanks Almar! 👍:skintone2: So the Email that they sent out was to basic!
*Thread Reply:* There also some discussions that you need Sentry 9.7.2 if you use Access.
*Thread Reply:* I am not sure if the M@W logs will help at all…. If the device can’t connect, you will need the device logs (if Android, use ADB) and your WiFi controller logs to determine the issue.
*Thread Reply:* No generic issue with this on 10.4.0.1 I believe; I did not see any issues so far with client certs.
*Thread Reply:* The controller is not even relevant at this point because it looks like the configuration is not being applied on the device because choosing the Wifi SSID manually prompts for a username and password
*Thread Reply:* But you are right, could also be an issue with the controller that CBA is not working at all
*Thread Reply:* Having said that it worked fine before the upgrade to 10.4.0.1
*Thread Reply:* Aha, so the config fails to be applied. Or the referenced client cert can’t be found. Something like that. Do you see the client cert on the device at all?
*Thread Reply:* Yes, the client cert is on the device. Also the wifi config has the status applied on Core
*Thread Reply:* I am using the same SCEP for Exchange.. Exchange works though
*Thread Reply:* Scep for Exchange or for Sentry ? Because the Sentry is not really picky about the cert: as long as it’s from the correct CA, the sentry will allow it. Did the Core push new client certs? You mentioned all devices fail to authenticate. If so, the Core must have pushed all new client certs to all devices.
*Thread Reply:* Yes, SCEP with Sentry (KCD) for Exchange, but of course without Sentry for Wifi. But we referenced the same SCEP in the wifi and exchange config
*Thread Reply:* Yes all devices stopped working.. Have not verified if Core pushed out new certs. Have verified that new enrollments get new certs and they also fails.
*Thread Reply:* I would check that first. Because of the following: if a device, registered prior to the upgrade to 10.4.0.1, did not get new client certs pushed, the “old” certs are still on the device. Hence, these devices should not fail to connect unless on another level something is failing (WiFi controller for example)
*Thread Reply:* If the Core did push out new certs to all devices; there was a change in Core or something else that forced that to happen. That might point to a Core issue and in that case, I would investigate, with MI support, what caused that to happen.
*Thread Reply:* Thanks Mark, I will investigate further! 👍:skintone2:
*Thread Reply:* Ok I have picked two sample devices. Core has not pushed out new certs for these users and the cert is still on the device, but choosing the SSID on the device brings up the dialog for username/password. Will check the controller tomorrow, but it seems that there is an issue with the wifi config. Found out that a lot of other devices are suddenly in the watchlist of the wifi config but nothing was changed within the config - not my sample devices though
*Thread Reply:* I had to remove the trusted certificate names of the network controller from the wifi config even though they are still valid!
*Thread Reply:* Is there more info within the error message? Whats your issue - prompting for an Apple ID?
*Thread Reply:* try refresgh vpp info to the platform
*Thread Reply:* usually means there is a licence allocation error
*Thread Reply:* Apple confirmed there are VPP issues that they are investing on
*Thread Reply:* Hopefully they are investigating 😉 🤣
*Thread Reply:* @NicolasR do you have a reference for that?
*Thread Reply:* not anything specific, just info I heard internally.
*Thread Reply:* havent seen this at a scep profile yet. We had a very similar problem with smime certs at email+. Seems it does not like all types of certificates/parameters.
Yea, MountainIron is the new brand, will be announced soon
*Thread Reply:* Hi Jean-marc, as far as I am aware - yes
*Thread Reply:* I implemented this in our staging environment -> you need to make sure that you got the certificate mapping in place - also the powershell script might add some further lines to the onload.js for the ADFS Web Theme that you are using for difference between Mobile and Workplace
*Thread Reply:* Thanks Armin, up & Running :)
*Thread Reply:* Nope - Tried to reboot - also retired and performed a new registration
*Thread Reply:* behavior stays the same
*Thread Reply:* Sometimes I can cancel the Docs@Work download and it jumps to the next app - but not always - and still docs@work never showed up on the oppo or pixel device
*Thread Reply:* I wouldn't count on anything working properly with oppo/Xiaomi/related, but on pixel that's unusual. Indeed cancelling the stalled app gets things moving for me, and it's not limited to WP.
*Thread Reply:* Yeah - I am not sure if I am hitting this issue on Pixel because of Android 10
*Thread Reply:* Because on Samsung with Android 9 everything is working - and I am also not a fan of those oppo devices
*Thread Reply:* but from Pixel I would have expected that this should be working without an issue
*Thread Reply:* Does it look ok on https://play/google.com/work
*Thread Reply:* I think you can do this with Advanced Traffic Control Settings on Sentry -> there you can specify a proxy and also specify which traffic should go through sentry directly allowed and what traffic should go through the proxy
*Thread Reply:* I am not sure if this is what you are looking for
*Thread Reply:* Is this a DEP device where perhaps the USB pairing is disabled? Can you pair the iPad to the Mac?
*Thread Reply:* Sounds like a DEP deployment in which the agent is deployed by VPP and hasnt been activated within 24h of enrollment
*Thread Reply:* post-provisioning but pre-enrolment?
*Thread Reply:* or post enrolment with the kiosk launcher and lock task active?
*Thread Reply:* Post provisioning, no kiosk.
*Thread Reply:* Known issues on going: trust.mobileiron.com
*Thread Reply:* appears to be fixed as per internal comment since 3:33 PM but need to rely on official status to be sure. 😉
*Thread Reply:* Oh shit.. ok thanks totally missed that ✌️:skintone2:
*Thread Reply:* Ok we found out that the notifications do not arrive outside of business hours. The work hours feature is disabled within Email+, but still no notifications arrive at the evening. Opening Email+ the next morning brings all the emails. Any ideas?
*Thread Reply:* iOS backups ? DEP or not ? if so, this has always been a big issue. There is a product bulletin within MI about it and in the comments everybody has its own recipe, which work for some and not for others...
*Thread Reply:* Do you also have MobileIron Tunnel app configured on the device?
*Thread Reply:* No, is it necessary? I think is only necessary configure in docs@work app: AppTunnel rule {"sentryHostName": "https://xx.xxx.net", "sentryPort": "445", "domainPattern": ["*. *"]}
*Thread Reply:* Tunnel app isn’t required. Sentry port try 443 “sentryService” appears to be missing, following sentryPort, such as “sentryService”:“CIFS”
Have it working fine with Kerberos auth
*Thread Reply:* Debug on Sentry will confirm if device is hitting it
*Thread Reply:* thanks I test port 443 and 445 with the same result. Finally it works, without tunnel app, without “sentryService”:“CIFS” in JSON. I don't know how. I hate JSON!! but thanks for all!!
*Thread Reply:* I only got this working by enabling all system apps in KME.
*Thread Reply:* Thanks, I just tried and you're right, Camera & Gallery are displayed in the personal profile only if you enable all system Apps in KME...
*Thread Reply:* i did have this issue with the beta, but 13.1 GA seemed to resolve this for me
*Thread Reply:* I have noticed this in 13.1 as well.
*Thread Reply:* Yes I've seen this personally in the beta and still with 13.1.2. Also noticed an increased uptick on when you reply it trims the body
*Thread Reply:* i was getting all of this in beta versions (every one since 13 became available) but im not getting this on my new iPhone 11 running non beta software
*Thread Reply:* exchange only or IMAP email too?
*Thread Reply:* any postings about this? The exchange guys are pointing the finger at Mobileiron
*Thread Reply:* definately not MobileIron, im just using nativeActivesync (although as mentioned no longer seeing the issue)
*Thread Reply:* we still are… Wonder if i need to update the users and setup email again
*Thread Reply:* We are seeing the issue with a managed mail profile directly to Office 365 (no sentry in the mix) so that should rule that out
*Thread Reply:* did you import the MI Root cert into your NTAuth store?
*Thread Reply:* certutil -enterprise -addstore NTAuth MobileIronCACertFilename.cer
*Thread Reply:* needs to be run by an Enterprise Admin I believe
*Thread Reply:* also what's your SSO config in MI and Tunnel SRV key pair look like?
*Thread Reply:* I've spent more time on this than I'd like to admin 🙂
*Thread Reply:* yeah id be using customer PKI/SCEP before adding local CA to the NTAuth store
*Thread Reply:* Kiran I did that but stil no result on the device
*Thread Reply:* this is my SingleSignOn config
*Thread Reply:* and the SRV record in the tunnel
*Thread Reply:* i think its in the certificate or some thing on de domaincontroller it self
*Thread Reply:* in the event manager i see a failed smartcard logon due to a certificate error
*Thread Reply:* Which local CA are you using now? MI Core Local CA?
*Thread Reply:* What do your safari domains in the VPN profile look like?
*Thread Reply:* have you tried in the SSO config the URL prefix to be http://.mmsdemo.nl & https://.mmsdemo.nl
*Thread Reply:* also try removing the application identifier to rule that out.
*Thread Reply:* for example if you're testing with a webclip the identifier is different I believe
*Thread Reply:* @Kiran Patel I'm using MI Local CA and changing the SSO config URL to http//.mmsdemo.nl is not allowed to do so i changed it to http://**.mmsdemo.nl but it does not change anything. I am still be prompted for username/password. if i leave out the certificate in the SSO Config the SSO prompt is showed. When i fill in the password i will be signed in.
*Thread Reply:* in the VPN in the safari domains i have mmsdemo.nl filled in.
*Thread Reply:* everything is working VPN and SSO except for the CBA part
*Thread Reply:* for Safari domains do you have MI Access with wildcard split tunnel?
*Thread Reply:* if not you may have to specific the DC's in there and specific web servers
*Thread Reply:* I believe we had the same issues with Core as local CA, SCEP via NDES works fine. I believe there is a document somewhere that for iOS SSO it is not recommended to use the local CA!
*Thread Reply:* are you testing this on a device that has iOS 13.2 Beta 1 by any chance? I actually recently faced issues with that but works fine for me in iOS 13.1.2
*Thread Reply:* Thanks, yes 🙏 - and your „test“ is the name of the OU, right?
*Thread Reply:* Yea, its blank if you open it without an entry inside the search list. Took a test OU for the screenshot. 🙂
*Thread Reply:* Do not think so. The user agent is part of the saml request, bundle ID not.
*Thread Reply:* some apps pass the bundle id in the user agent
*Thread Reply:* so based on that you can create rules
*Thread Reply:* Do you have an example of an app that does that?
*Thread Reply:* salesforce I think, let me check
*Thread Reply:* my bad. It’s not the app that sends that but MI Tunnel
*Thread Reply:* Here is the UA for Salesforce app: SalesforceMobileSDK/7.0.0 iOS/12.4 (iPhone) Chatter/220.3(6138468) Hybrid uid2B90ADF6-05B4-4532-8BAD-6701CE66C82B ftrMM Mozilla/5.0 (iPhone; CPU iPhone OS 124 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 iPhone/12.4 iOSiPhone Salesforce1/220.3(6138468)
*Thread Reply:* MS office apps send bundleid but it’s not in user agent
*Thread Reply:* Any way to have the CA policy look at BundleID rather than UserAgent?
*Thread Reply:* I tried that - looks like this but doesn't seem to work
*Thread Reply:* Your issue is because of the wildcard character I think. You should just put “com.microsoft.office” and select partial match
*Thread Reply:* I’m on a call with a customer and looks like the bundle id is not being reported every time. I guess we report that when “CertSSO” is enabled (the zero sign on experience for mobile)
*Thread Reply:* No we use custom APNs with our physical SIM cards and we deploy the APn via MobileIron. Now we want to do the same with the eSIM devices. Not sure if the provider has to put that information within the QR code for the setup of the eSIM or if we can continue to use the APN deployment via Core
*Thread Reply:* I do not think that is possible. The cellular payload does not mention anything about eSim at all. Maybe they have set it up very generically, and works with any voice/data service, but I doubt it.
*Thread Reply:* shouldn't the APN policy apply to eSiM also. Why would it be different?
*Thread Reply:* That is exactly what is was wondering. Apparently it is not working. But the cellular payload does mention: A cellular payload configures cellular network settings for the user-selected data SIM on the device. I have no experience with the eSim and I am unsure what Apple means by "user-selected data SIM" in that respect.
*Thread Reply:* The user needs to select which sim (eSim or physical) should be used for data. That sim could then be configured with the policy
*Thread Reply:* Yes thats what I thought too. But we have only the eSIM active on these devices for now, and the APN pushed from Core is not being configured on the device.
*Thread Reply:* What is the problem? That you are able to go to the internet without Tunnel? Or something else?
*Thread Reply:* Looks like when tunnel is disabled, Chrome has full access to the net where the expectation is it’d be unable to do anything if tunnel is off?
*Thread Reply:* hi team, When Tunnel is disable, i can go to internet.
I think is put in chrome
AllowedAppList com.android.chrome
SplitDomainsList
SearchDomain
If the tunnel is disable, you can not use chrome. Is this incorrect?
*Thread Reply:* If you want to force it through Tunnel, tunnel should be set to Always On so that the user can't disable it
*Thread Reply:* I activated this in the enterprise profile with the same result
*Thread Reply:* Could it be that Zero Touch Enrolment has been set up on the phone?
*Thread Reply:* You can use Pwd+PIN (User Settinghs)if you haven't integarted an IDP. If you have, obviously you can use MFA from there
*Thread Reply:* Select the iOS device on Core > Actions > iOS only > Send Activation Lock Bypass Code.
*Thread Reply:* You can disable the activation lock if your devices are supervised. That's a bit easier
*Thread Reply:* Why would I want to disable the activation lock?
*Thread Reply:* Because you do not need it on corporate supervised devices... you have a Wipe command and the devices are DEP I assume. So the activation lock does not add anything
*Thread Reply:* If lost you can put it in Lost mode...
*Thread Reply:* So find my iPhone with its activation lock is just an annoyance and does not add any extra protection.
*Thread Reply:* But wait.. our devices are corporate owned (and DEP enrolled) but personal use is allowed. So we can (and we did) end up with active private apple ids on the device. Sure we can wipe it via Core, but the private apple id would still prompt after it comes back up, right? Or will the DEP enrollment override this?
*Thread Reply:* With supervised devices, the Activation lock is per default turned off. Are you on MobileIron Core? If so, check your Security Policy. It will have an option to turn on/off the activation lock. Now it seems to be turned on. You can turn that off. It still allows the user to use the iPhone for personal stuff. Only his/her Apple ID will not be associated with Find my iPhone, which enables the activation lock.
*Thread Reply:* Yes. find my iPhone still works even if you disable activation lock for your DEP devices. No need for activation lock in the enterprise
*Thread Reply:* @Mark Vonk ah now it seems a bit clearer! Thanks.. yes we are on Core and the Activation Lock is ON within the Sec Policy. Just because we thought we will need it for the personal apple ids. Did not now that the find my iPhone feature is not relevant for personal apple ids for DEP enrolled devices! Thanks!
*Thread Reply:* Yes. Remember : find my iPhones ≠ activation lock. The first may or may not enable the latter
*Thread Reply:* Yes but might need some manual SyncML work... Good luck then!
*Thread Reply:* I’ll advise to ask PS to do that
*Thread Reply:* Thanks, I will look into it :female_technologist:
*Thread Reply:* Am I blind or is there no documentation how to setup Bridge anymore?
*Thread Reply:* It’s this super intuitive guy here https://help.mobileiron.com/s/mil-productdocdetailpage?TOC=Contents-1312028976&URL=MobileIron-Core-10-5-0-0-Device-Management-Guide-988678228&selectedversion=10.5.0.0&Name=MobileIron%20Core
*Thread Reply:* did you also enable cert based auth on the domain controllers ?
*Thread Reply:* check with "certutil -DCInfo" as domain admin
*Thread Reply:* Always test with username password first and then enable cert later 🙂
*Thread Reply:* I’ve not seen one recently. @NicolasR might have a better idea since it’s a MI product.
*Thread Reply:* Right, also not seen anyone in the documentation. But in the past I was provided with hidden KVPs which have not been exposed in the docs! 😜
*Thread Reply:* Nope, nothing either internally
*Thread Reply:* I think that makes MobileIron the first to market with “Z-FOTA”? Nice
*Thread Reply:* This part is confusing. The article is supposed to announce support for LifeGuard OTA but then it takes a turn by saying that only MX via OEMConfig is supported and that LifeGuard OTA is coming in the future?
*Thread Reply:* MobileIron will support Zebra FOTA as soon it’s available from Zebra (early access in R67 for Cloud and GA in R68/CORE 10.6 in January). From what Zebra told us we are the first in market
*Thread Reply:* Correct. Self-signed are not supported with iOS 13 and macOS Catalina.
*Thread Reply:* https://support.apple.com/en-us/HT210176
*Thread Reply:* Thank you @Jason . In the article you provided I cannot find anything about self signed is not supported. These requirements could also be fulfilled with self-signed certs, could they not?
*Thread Reply:* Ah found it - its the EKU which is not present with private CAs 😜
*Thread Reply:* Self-signed certificates been deprecated by Apple for a while now. For example, iOS 10.3 tightened up on this futher: https://support.apple.com/en-us/HT204477
*Thread Reply:* But presumably in this case you’re using a local (self-signed) CA to issue these leaf certs for the users?
*Thread Reply:* I think I found the answer within the AC:
I gotta test if this will also prevent the modification of other accounts or only this specific one!
*Thread Reply:* Ok so this prevents the user from turning ON/OFF the services within the settings, but the contacts can still be edited. I believe there is no payload for that. Gotta look if there is a way with Office365 to make the contacts not editable
*Thread Reply:* Also the problem is - if one account for outlook.office365.com is configured you cannot add a second one with the same fqdn. Is there a working alias for that? outlook.office.com doesn’t work
*Thread Reply:* I dont get it why people think it is important to see who is calling if the person is not important enough to be in my contacts... But maybe one of the GAL Sync Apps out there is an option? They are read only afaik.
*Thread Reply:* You are absolutely right - beats me! Yes I am looking into CiraSync and co. Also I am currently trying to remove all the permissions via Powershell (Add-MailboxFolderPermissions) for the contacts - has no effect. Can still edit items on the iPhone
*Thread Reply:* FYI, CORE 10.6 will support these payloads
*Thread Reply:* @NicolasR you mean the payloads of my screenshot above or payloads for prevent editing contacts?
*Thread Reply:* it’s about prevent editing account
*Thread Reply:* Do you have any details on that I could share?
*Thread Reply:* What magic number? I don't know any recent document from MI on that.
*Thread Reply:* You can set up a Mail config to push a plain text signature. no images, html or variables.
*Thread Reply:* I don‘t see an option for email signatures within the Exchange config on Core to achieve that.
*Thread Reply:* Im not sure if its Email+ only or general setting, dont have an MI Core at hand
*Thread Reply:* afaik email+ only. Signature for Active Sync is a planned feature for Microsoft Exchange but don't ask me when it will be available.
*Thread Reply:* When the setting will be pushed to the device you’ll get a notification that asks to go in settings to set the password
*Thread Reply:* then you have a safari view that prompts and if ZSO is enabled, the view closes after few seconds
*Thread Reply:* Ah ok thanks for the details.. we don‘t have MI Access so no ZSO yet. So the users will have to authenticate manually for now, no big deal for a pilot. The only hurdle could be that the users will not go into the settings or will not find it
*Thread Reply:* Just configure and enable the second interface. Make sure you add the correct routes (and default route) and it should work like a charm
*Thread Reply:* I can confirm it works as expected. Thanks for your help!
*Thread Reply:* With core its EMM/Appconnect or MAM/Appstation. You will need a another Core.
*Thread Reply:* We are having similar issues. We were not able to have this fixed, yet. And automatic sync does not work for us.
*Thread Reply:* Is the Cert itself enabled for encryption and signing? Is signing and encryption configured in the Exchange Config? What if you disable signing and only leave encryption? Is the Cert also Apple trusted? I would push the Root Cert of the CA regardless of trust. Are the pub certs of the recipients avaliable in the GAL?
*Thread Reply:* You bring up very good points. 1.)The same Cert is already being used on Outlook desktop, so I believe signing and encryption should be in them. 2.)yes, both enabled in the Exchange config. 3.)gotta test if encryption only works 4.)verifying that if it is Apple trusted 5.) so the root cert of the external trusted CA, ok gotta check that. 6.) not sure about that.. is that relevant if the error comes up with choosing „compose new email“.. not sending it, getting the error before that.
*Thread Reply:* 6.) This problem should become visible when you try to add recipients to an new mail.
*Thread Reply:* We found out that the validity of the cert is 3 years! Regarding to the Apple requirements for iOS 13, this is definitely the problem! 😳 also I can’t see id-kp-serverauth OID in the details of the cert! Not sure If I should see it, or if it is only visible showing the details via OpenSSL
*Thread Reply:* Afaik in either case, the private key must have the “Secure Email” extension OID (1.3.6.1.5.5.7.3.4) as an EKU, and (for email signing):
- must have the Digital Signature or Non-Repudiation OID’s as a Key Usage. (for email encryption): - must have the Key Agreement or Data Encipherment OID’s as a Key Usage.
*Thread Reply:* afaik 3 years should not be the problem, since this Apple requirement on that is only for Server Auth not for Client.
*Thread Reply:* Ah ok thanks.. By any chance you have the client requirements outlined by Apple? Obviously I have the wrong one.
*Thread Reply:* afaik Client Certs only need to be trustworthy for the device and the Server they using them agianst need to comply https://support.apple.com/en-us/HT210176 and also trustworthy to the device
*Thread Reply:* did you find the problem?
*Thread Reply:* No not yet. Still investigating
*Thread Reply:* @Phil Hackett they are right in that revoking certs will make the CRL grow. Office365 just recently "finally" documented that 20mb and 10seconds are your limits for CRL in Azure... This would be around 400,000 certs....
*Thread Reply:* BUT never issue certs without a procedure for revoking them again... you also don't print paper with your password and hand them out
*Thread Reply:* Thanks @Peter Mohr . Good info regarding the CRL limits. We’re looking at using API’s to automate certificate revocation on CA side.
*Thread Reply:* https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory-certificate-based-authentication-get-started
*Thread Reply:* This isn't really a good approach to app management.. without deleting the apps I'm not sure you'll be able to do too much. Perhaps create a new space and properly separate AE from legacy? I've not touched MI for a bit though so @NicolasR any tips?
*Thread Reply:* On Core spaces can do the job. AE must be on the global space
*Thread Reply:* We’re on Core but not utilizing spaces. Can you send me a link to the documentation?
*Thread Reply:* Which one are you on? Just got a message NA2 is having issues.
*Thread Reply:* @Phil Burk You should subscribe to updates: https://trust.mobileiron.com Yesterday there was an outage on NA2 yes.
*Thread Reply:* not yet afaik. Only JAMF and Intune(partially)
*Thread Reply:* It’s definitely possible using the MobileIron Provisioner app. Just download it from the Play Store and you can create QR code’s for enrolling Work Managed devices.
*Thread Reply:* I've already downloaded the Provisioner app - It's from that app, I'm prompted for a token (and host name or user name), but I don't know where to find it in the console?
*Thread Reply:* Are you on Mobileiron Cloud or Core?
*Thread Reply:* Ok it’s the “bulk enrollment” menu
*Thread Reply:* Then you create your CSV and it creates a unique token for you
*Thread Reply:* So you have to know which devices will enroll first?
*Thread Reply:* are you talking about the bulk enrollment part of the provisioner app?
*Thread Reply:* or is there somewhere on the dashboard/console, where I can find it?
*Thread Reply:* Bulk enroll is to provision devices based on a S/N or IMEI yes
*Thread Reply:* You can ask for credentials and depending on options it can be a Pin or password
*Thread Reply:* ahh - ok. So MI needs to know the device before accepting the token within the QR when enrolling?
*Thread Reply:* This unfortunately makes it a bit more cumbersome than the competition Intune and MobiControl 😞
*Thread Reply:* For some of my setups, it makes good sense to have devices that aren't related to one particular user - Rugged devices and kiosk devices..
*Thread Reply:* where do I create the CSV to obtain the token from?
*Thread Reply:* ahh - I think I found the Bulk enrollment tab and have downloaded the csv template.
*Thread Reply:* So no, MobileIron does NOT need to know the device before
*Thread Reply:* We just need to know if you want avoid any user prompt and enroll the device with only the QRcode
*Thread Reply:* Basically if you can share the use case you try to achieve we can see how to solve it 😉
*Thread Reply:* he he - thanks! I just want to be able to enroll the devices into kiosk mode with as little as possible user interaction. Normally I'd just add an enrollment token into the QR code and the management system will figure out which tenant to send the device to and which configuration might need to be applied.
*Thread Reply:* I was expecting to be able to point at a particular device group from a given token, but I still need to figure out where to generate/find the token to add to the QR (if this is the way to achieve this in MI) 🙂
*Thread Reply:* The use case would be decentral staging of devices that have been shipped directly to a depot or warehouse and the local IT should be able to enroll the devices by a scan of a barcode.
*Thread Reply:* I guess it should be the same token as used when doing zero touch as the json is pretty much the same 😉
*Thread Reply:* You should use a “technical” user account where all your warehouse devices are associated to. These devices will have a QRCode with the username and password for this account
*Thread Reply:* Important to note is if you are using Android enterprise, check the “device account” setting in the user account settings. This will avoid being limited to 10 devices per user account
*Thread Reply:* So I can't use a token instead of a user and PW? Do I need to have the username and pw inside the QR code?
*Thread Reply:* In that case, the user staging the device will always need to know the password of the 'technical user'?
Has anyone attempted to customize the status info field within M@W for iOS? I would like to add the actual reasons but can’t find where to edit it within Core.
*Thread Reply:* Haven't tried in a while but I believe this may be in the event center?
*Thread Reply:* Yeah, I tried event center and that seems to only send the info via a Push notification, it doesnt populate this section.
According to KB article this was "expected for late 2019". Well, it is 2020 now and the article was not yet updated. Would be great to get some news regarding this. (https://help.mobileiron.com/s/article-detail-page?Id=kA12T000000TOVjSAO)
}
Well Apple finally communicated a date after which new and updated apps using UIWebView API’s will no longer be accepted in the AppStore. This means that companies using Web@Work (and possibly Docs@Work) will need to start planning a migration to WkWebView and Per-App VPN.
https://developer.apple.com/news/?id=12232019b
*Thread Reply:* can you be more specific? with O365, with or without sentry, just configs, etc?
*Thread Reply:* IMHO this only applies to MobileIron Go
*Thread Reply:* Create an exchange config as per usual but set authentication to oAuth
*Thread Reply:* @Mark Vonk Do you know if Apple ever incorporated a means to deploy an Exchange config, but only with Mail or Calendar or Contacts enabled once it installs?
*Thread Reply:* Yes, since iOS 13.
See: https://developer.apple.com/documentation/devicemanagement/exchangeactivesync
Check the EnableContacts, etc. properties
*Thread Reply:* Nice @Mark Vonk - I had a brief recollection of this feature actually coming to life (since we had asked about it dating all the way back to iOS 9). Oh, happy day 🙂
*Thread Reply:* @NicolasR I show 10.5.1.0 GA. Is 10.6 in Beta?
*Thread Reply:* March 4th for GMRC is the target
*Thread Reply:* Hey Eric, HNY! Hope things are well with you. Depends on a couple of factors including whether you want to take action on the device or you want MI to perform remediation. When you enable local VPN capabilities in Phishing Threats in the ZConsole, it also maps back to the Site Insight Threat Policy where you can perform either device actions or set the remediation in the MDM Action. You can remove, block, quarantine or wipe if you would like. You can also block known phishing URL's at the device level if needed. You want to take a look?
*Thread Reply:* @Paul Troisi is this with updated phishing detection with their VPN capabilities or with the content blocker integration? I haven't looked at this in 6 months or so
*Thread Reply:* Yes, with their VPN on activation, as well as using their own VPN on the device.
*Thread Reply:* @Paul Troisi - Nice! I’ll give you a shout tomorrow. If we’re able to perform comprehensive remeditation on the device (before a user has time to tap/click into a phish attempt) this could be worth its weight 🙂
*Thread Reply:* Any docs on the help site about this?
*Thread Reply:* @Kiran Patel I’m gonna hop into the ZConsole and will look. If not there, @Paul Troisi may be able to scour their help site.
*Thread Reply:* Yup you can, everything is in the documentation for the key value pair
*Thread Reply:* Well, I have looked in the Email+ documentary, but not really a lot of infos there how to configure the default signature for AE! Key value pairs are not relevant for AE! Maybe we are talking about different docs.
*Thread Reply:* Ok so I was more thinking on iOS side. So for AE you’re right, not required to add KVP, but definitely the standard variables should work as you mentioned
*Thread Reply:* Tried several times with some customers… Not a good idea 😉 And not officially supported
*Thread Reply:* Thank you Phil for letting us know. I was also checking this in the morning and was surprised to see this is not available.
*Thread Reply:* May MobileIron is forcing the Core-2-Cloud migration. 🙂
*Thread Reply:* I am almost sure, there was a Violation of Repetitive Content policy (Mobile@Work and MobileIron Go). We had this problem a few weeks ago with our Enterprise Apps. It was taken about 24 hours to get them back to Managed Play Store. Reason:- We maintain 3 apps for 3 different environments (test environment, integration environment, production environment). But If you publish your Enterprise apps with iframe, then you can bypass the problem, because they are permantently private marked and will only scanned for malware. Sure, that is not a solution for MobileIron, but may for somebody here.
*Thread Reply:* It is actually an issue with the Phone Call logs permission the M@W cliënt claims. It is not allowed for regular apps, but MDM clients are exempt after some kind of waiver. Apparently the app was withdrawn by Google despite the waiver. Google is already working on it to get it back.
*Thread Reply:* @Melkon Torosyan we have a much more efficient way to move customers over to cloud without requiring re-enrollment so 😉 As Mark said, it was a mistake from Google Play team and Google AE team have worked with them to restore our app. By the way we had to change the version number as per Google requirement
*Thread Reply:* Hi, this seems to be resolved at this time: https://help.mobileiron.com/s/article-detail-page?Id=kA12T000000TUgVSAW 🙂.
*Thread Reply:* You might check wether the app is excluded from battery optimization. From android 6 ( i think ) doze mode or app standby might put apps in deepsleep if it uses too much battery power.
*Thread Reply:* https://developer.android.com/training/monitoring-device-state/doze-standby
*Thread Reply:* Thanks I will check it out. Sounds like the problem
*Thread Reply:* Does the pkcs12 file contain full certificate chain?
*Thread Reply:* If we upload the file in the admin portal the whole chain is visible. Also if you install it on a Windows Client. Only Sentry MICS will not accept it.
*Thread Reply:* I saw similar error in the past with S/MIME certificate and key alias matching. Try to import the cert to Windows machine cert store, then export it with PK and full chain and import that file to MICS.
*Thread Reply:* Had the same. Converted the cert with openssl. Then it worked.
Isn’t this the TLS certificate on Core? This is still valid but some users receive this:
*Thread Reply:* Does the Certificate comply to the iOS13 requirements?
*Thread Reply:* Ah so you believe the server certificate which is used for TLS (same as the portal certificate) does not comply with iOS13? If I browse with Safari to Core from the device it should also not work regarding to your theory, right? (Which works without issues btw)
*Thread Reply:* No issues with the health checker
*Thread Reply:* How about it:
https://help.mobileiron.com/s/article-detail-page?Id=kA134000000QxFxCAK
*Thread Reply:* I'm reading up on Cloud R69 there is some client cleanup "Remote service TLS client AUTH certificate weak signature < SHA384 renewal" being done. Not sure if this will also happen in the upcoming Core release.
*Thread Reply:* I would not use profile manager in production - think of it as a reference implementation that is great for testing
*Thread Reply:* Me too, but is there a fact comparison to a professional MDM System ?
*Thread Reply:* Profile Manager is only for testing, as it can’t scale up for production use. Even Apple admit it.
*Thread Reply:* Yes, both fully managed with work profile and work profile on BYOD.
*Thread Reply:* Mobile@Work 12.2.2 has been released that resolves this issue.
*Thread Reply:* The update is nicely on time before the mass upgrade to iOS 13.4 starts….
*Thread Reply:* Nope, not yet supported. I just recently asked our technical presale contact in relation to 10.6 release.
*Thread Reply:* As far as I know it‘s not in 10.6
*Thread Reply:* Please raise request to MI if you want to see this implemented in the future. This is imo big oversight fro MI side as support of that feature will be perfect for Email+ users struggling with contacts sync to native contacts.
*Thread Reply:* Yeah, I was thinking that was going live in 10.6 as well
*Thread Reply:* I was thinking that that you could create your own XML and use it… like we did for a lot of Dock/Home Screen setups before it made its way into the Core UI
*Thread Reply:* Depends if you need to include Identity cert via SCEP or not.
*Thread Reply:* Anyway, this was one of the first iOS13 features supported by WS1 UEM. In my opinion easy to implement and quick win.
*Thread Reply:* Yeah / That feature could have been used SO many times for projects I was on in the past.
*Thread Reply:* It is even implemented in Intune... We have already raised this to MI, because some of our customers need this
*Thread Reply:* It was indeed set for 10.6, but fell off for some reason. The next version of Core and Cloud are supposed to have it as these are focused on iOS / macOS
*Thread Reply:* This very disappointing. Come on #mobileiron you can do better than that!
*Thread Reply:* @Mark Vonk does this mean Cloud doesn’t have it either?! Wow what a big miss. I’ll mention it on my call with them on Tuesday
*Thread Reply:* pushed this up to MI mgmt that this is critical feature request for our company. We would like to sync just contacts and drive calendar / mail to Outlook app. does anyone have advise on how to try this through a custom payload but embed the scep cert as @Ladislav Blazek alluded to?
*Thread Reply:* @Kiran Patel this could help you https://mosen.github.io/profiledocs/payloads/common/exchange.html - it is possible to associate an SCEP credential with an Exchange configuration via the PayloadCertificateUUID key. You need to extract that reference from mifs database.
*Thread Reply:* I thing the easiest way is to use Apple Configurator / Profile Manager to create Exchange profile with fake SCEP config and then replace reference to real SCEP payload.
*Thread Reply:* thank you - thats what we are trying. was trying to get the formatting of those parameters for the xml as even apple documentation has the details but not he format
*Thread Reply:* wish @John Zmyslowski and I luck 🙂
*Thread Reply:* @Kiran Patel Actually I am working on it right now as well as we have request from our customer for the same.
*Thread Reply:* lets keep each-other updated :)
*Thread Reply:* I also see a cert pw and cert payload when I export the exchange config from MI
*Thread Reply:* @Kiran Patel so far no luck. Unfortunately SCEP payload must be part of the same configuration profile as Exchange payload to be able to reference it…
*Thread Reply:* @Ladislav Blazek We are close but appear to be having a variable substition issue
*Thread Reply:* not sure what format $email$, etc needs to be in
*Thread Reply:* if i hardcode the email in the profile appears to honor it but haven't tried it with scep issuance
*Thread Reply:* with a hard coded profile I did get the oauth auth part working with contact only honored
*Thread Reply:* <?xml version=“1.0” encoding=“UTF-8"?> <!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”> <plist version=“1.0”> <dict> <key>PayloadContent</key> <array> <dict> <key>EmailAddress</key> <string>$EMAIL$</string> <key>EnableCalendars</key> <false/> <key>EnableCalendarsUserOverridable</key> <false/> <key>EnableContacts</key> <true/> <key>EnableContactsUserOverridable</key> <false/> <key>EnableMail</key> <false/> <key>EnableMailUserOverridable</key> <false/> <key>EnableNotes</key> <false/> <key>EnableNotesUserOverridable</key> <false/> <key>EnableReminders</key> <false/> <key>EnableRemindersUserOverridable</key> <false/> <key>Host</key> <string>misentry.test.local</string> <key>MailNumberOfPastDaysToSync</key> <integer>7</integer> <key>OAuth</key> <false/> <key>PayloadCertificateUUID</key> <string>65EF21E0-5F39-461E-AB63-ED00D2D4BB45</string> <key>PayloadDescription</key> <string>Configures an Exchange account</string> <key>PayloadDisplayName</key> <string>Penta Contacts Only</string> <key>PayloadIdentifier</key> <string>com.apple.eas.account.D0F55C47-4633-42F1-8651-96E05A017DA0</string> <key>PayloadType</key> <string>com.apple.eas.account</string> <key>PayloadUUID</key> <string>D0F55C47-4633-42F1-8651-96E05A017DA0</string> <key>PayloadVersion</key> <integer>1</integer> <key>PreventMove</key> <true/> <key>SMIMEEnabled</key> <false/> <key>SMIMEEncryptionEnabled</key> <false/> <key>SMIMESigningEnabled</key> <false/> <key>SSL</key> <true/> <key>UserName</key> <string>TEST\$USERID$</string> <key>disableMailRecentsSyncing</key> <true/> </dict> </array> <key>PayloadDisplayName</key> <string>Exchange Contacts Only</string> <key>PayloadIdentifier</key> <string>MBP-LB-S4U-9.FF125D06-169C-4ED7-80BC-3BC537D65084</string> <key>PayloadRemovalDisallowed</key> <false/> <key>PayloadType</key> <string>Configuration</string> <key>PayloadUUID</key> <string>2143B430-F9F1-49BA-8642-A2832A4DF3D4</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </plist>
*Thread Reply:* @Kiran Patel that worked for me for basic auth.
*Thread Reply:* $EMAIL$ and $USERID$ is correctly substituted by the real values for the user
*Thread Reply:* But PayloadCertificateUUID part don’t work as the SCEP payload is not part of this custom profile. We need something like $CERTALIAS:<scepprofile_name>$ to make this working.
*Thread Reply:* do you think the scep appsetting uuid suffice?
*Thread Reply:* @Kiran Patel as I said unfortunately no. SCEP payload must be included in the same configuration profile.
*Thread Reply:* @Ladislav Blazek the SCEP cert itself or reference to the existing scep config that's already in core? that's the part where I'm getting lost comparing the exchange config out of MI and looking at the apple documentation
*Thread Reply:* I think I follow what you're saying now... I recall when I tested android enterprise around 2.5 years ago and used it in the AE configs
*Thread Reply:* too bad we can't enbed that in the <certificate> parameter
*Thread Reply:* Automatic login? What appliance? Typically you should perform an Enable command first to perform any configuration. Without Enable you can only view certain information.
*Thread Reply:* MobileIron Core. If I connect via VMware console it always performs an automatic login and I have no idea why and where this comes from! Connecting via SSH of course doesn’t
*Thread Reply:* normally we set it to match the exchange limits, to get continuous usability to desktops. With LTE and a good carrier we normally dont see failed delivery often.
*Thread Reply:* Since Packet tunnel (last major update of tunnel - summer 2019), macOS tunnel is good. Chrome and other apps like teams can now be tunneled to provide password less experience. I use it daily on my work MacBook and no pain anymore.
*Thread Reply:* @NicolasR wonderful! I wanted it to work so bad when I was testing it (vs WS1 Access)
*Thread Reply:* @NicolasR can you confirm that this only works on Catalina?
*Thread Reply:* @Woody not as far as I know, our company switched to Packet tunnel even we still have Mojave devices in the field
*Thread Reply:* I was working on a PoV last week with MacOS and came across this (https://help.mobileiron.com/s/article-detail-page?Id=kA12T000000TQKLSA4)
*Thread Reply:* Oh right this is something that I forgot! This is what made me upgrade to Catalina
*Thread Reply:* Not on Mojave. I have a MBP that’s on Catalina, but it’s bound to JAMF
*Thread Reply:* As far this issue happened to me I was running Tunnel with App-Proxy, different than Packet-Tunnel. Maybe packet-gunnel doesn’t have this apple bug
*Thread Reply:* k! Let me flip it over to Packet Tunnel and see if that has any bearing on the outcome
*Thread Reply:* @NicolasR Packet Tunnel doesn’t seem to have any different result. Tunnel/VPN profile are installed, but it doesn’t connect on-demand
*Thread Reply:* @Woody with packet tunnel don’t use safari domains as it’s different. Try with match domains.
Also.... please don’t test macOS on CORE... It’s a bad idea....! Unless customer can’t be on CLOUD for whatever good reason (government/ministry,...) use Cloud!
*Thread Reply:* Our Cloud product is good for macOS management, not Core to be fair
*Thread Reply:* Unfortunately, we’re going to be w/ CORE for quite some time. Just trying to get as much ROI from the product as possible. It’d be really nice to replace JAMF w/ CORE since it’s servicing only one platform.
*Thread Reply:* We did that also with a customer here but limitations are huge: • No client auto-registration for DEP devices • Scripts need to be signed - painful • No MIP format support (only PKG which also requires signing) Product on Cloud is so much ahead... Seriously, don’t do that with CORE and work rather on CORE to CLOUD migration for iOS/Android devices, our migration product is so easy and works so well (seriously speaking, don’t see any commercial approach here... it just works!)
*Thread Reply:* I totally hear you @NicolasR / Just in a position where what we have is working and we’re focusing $$ on other areas/efforts. What we may do is try to spin-up Cloud in parallel, but for now everything needed (we’re basic, Bro) is good in Core.
*Thread Reply:* This managed config is not meant for pre-configuration of the account. IntuneMAMUPN will just mark the corresponding corporate account as managed inside Microsoft apps to distinguish it from personal.
*Thread Reply:* Thanks. So it‘s not possible to pre-configure Office apps with MobileIron?
*Thread Reply:* It is possible to preconfigure Outlook. Then you should be able to see account as available in other Microsoft apps (as they are allowed to share OAuth token in iOS Keychain).
*Thread Reply:* I know it‘s possible that way, but that‘s not an option for the customer. Thank you
*Thread Reply:* Use MobileIron Access for Autologin ;)
*Thread Reply:* For the most seamless experience here’s what we’ve tested and are hoping to roll out soon.
1) push MI Tunnel, Microsoft Authenticator and MS Outlook to devices with iOS Managed App Config to preconfigured. Authenticator will need the vpn tunnel profile associated with it. 2) using MobileIron Access the Auth experience will be completely seamless (iOS managed app Config gets the username and home realm discover done for the O365 tenant). Outlook will flip to MS Authenticator and Ms leverages it almost as an SSO broker app. This also prevents having to attach the vpn tunnel profile to all other apps that does impact their performance a bit (even if you split tunnel) 3) once MS Authenticator has the Auth token and as a result the iOS keychain as Ladislav suggested another MS Office apps share it and no username or pw Auth will he needed. Worst case it flips to MS Authenticator which already maintains user identity even if it needs to Auth again
*Thread Reply:* but keep in mind Authenticator will hand the auth token also to other MS apps you might not want to use or cover as Managed.
*Thread Reply:* replace https:// with chromes:// and http:// with chrome:// 🙂
*Thread Reply:* I knew there was something like that, just as for the web@work browser.. Thanks!
Help@Work setup error when I click on Validate, any ideas? Firewall?
*Thread Reply:* 10.6.0.0 - was a FW issue. Teamviewer was blocked!
*Thread Reply:* Well done!! I may give MI a spin given this.
*Thread Reply:* I primarily deal with Zebra Android in dedicated device situations. I see that you offer LifeGuard OTA and OEMConfig for MX support.
*Thread Reply:* Can you also support direct LoB app installs (bypassing Managed Play) for AEDO deployments? And what about File Management capabilities? Can you provision files into specific directories on the devices?
*Thread Reply:* MI supports direct apk installation, but not silently unfortunately (someone correct me if I’m wrong please).
*Thread Reply:* There are no file management capabilities unfortunately (again - someone correct me if I’m wrong please), so you’ll have to do with the OEMconfig, where it’s hard to accomplish an install process with a baseline (receiving a baseline config) and different levels (could be warehouses) where other files and configs are needed. At least, I have still to figure out the great method.
*Thread Reply:* Thanks for the insights! Agreed that, while FileMgr is there in OEMConfig, it is not ideal to have all the configuration settings in a single policy like that. OEMConfig also relies on Managed Configurations which I’m fairly certain would have been affected by the Google Play server outage over the past couple of days. We can’t have that sort of issue in mission critical device deployments.
*Thread Reply:* Without file management capabilities MI would be DOA for us. We have numerous external config files that we distribute that need to be placed in specific directories on the devices.
*Thread Reply:* it works, I have some customers using it and I helped one setting that up last week 😉
*Thread Reply:* but deprecation postponed due to covid
*Thread Reply:* Really? Is there an official statement from Apple?
*Thread Reply:* Hello! I do not believe so, but @Russell Mohr or @NicolasR may able to shed more light on the subject.
*Thread Reply:* Mobileiron university online is free for our partners and customers
*Thread Reply:* Ah yes. I was thinking @Luiz Nascimento was alluding to Instructor Led training.
*Thread Reply:* We do that locally for partners sometimes with instructor
*Thread Reply:* Got it Thanks @Woody and @NicolasR
*Thread Reply:* Ok got it thanks. So CNS v1 will not be impacted by that?
*Thread Reply:* vip notifications need cnsv2 to work now. its a new requirement for vip notifications to work. if your users are not using vip notifications, you dont need to implement them the new way. cnsv1 has problems, so it is a good idea to implement v2 regardless of vip notifications: https://help.mobileiron.com/s/article-detail-page?Id=kA134000000QxdxCAC
*Thread Reply:* Can you share your config? Did you added apptunnel rules on it? (You should not)
*Thread Reply:* Rookie mistake.. someone imported the wrong root cert! :facepalm::skintone_2:
*Thread Reply:* 👍 Always good to look at the config on monday morning after good rest right? 😉
*Thread Reply:* Javascript is supported but I know some specific technologies are not supported through Tunnel like Web socket
*Thread Reply:* MobileIron mentioned also Microsoft Outlook as an alternative - can Outlook be used with Kerberos Constrained Delegation? I don‘t see any fields in the app to put the SCEP in like with Email+ so I guess not - Update: so I found an article that Sentry is not supported so that answers my question. No KCD without Sentry. Right?
*Thread Reply:* Ok, so just push M@W as app to install upon enrollment. It will self-register when user opens it.
Be careful by default the registration windows is 4hours but can be changes in the UI starting Core 10.5+
*Thread Reply:* So you mean it can take up to 4hours until the self-register will work?
*Thread Reply:* user has to open M@W during 4hours window
*Thread Reply:* but 4hours window can be set to higher value
*Thread Reply:* 4hours until M@W was pushed or after the DEP enrollment
*Thread Reply:* Count down starts when M@W gets installed
*Thread Reply:* Where do I find the setting to change that value?
*Thread Reply:* sorry my CORE is broken at the moment can’t check exactly where...
*Thread Reply:* Awesome - thank you. 👍👍 helped me out tremendously!
*Thread Reply:* @John Zmyslowski check this thread. @NicolasR can the 1 year extension window for Mobile@Work activation also occur for MI Cloud & MI Go App?
*Thread Reply:* also have you users tiered compliance actions and notification rules in MI Core to prompt the user to launch the app?
*Thread Reply:* great info here as always @NicolasR
*Thread Reply:* @Kiran Patel on Cloud the window is 24hours but renewed every time, so basically no limit 😉
*Thread Reply:* No, setting won’t change unless doing it manually
*Thread Reply:* @NicolasR Just to clarify, updating the security policy on the device (to a value greater than 90 days) would not extend the length on the device?
*Thread Reply:* it should work, as it’s not a device local setting
*Thread Reply:* not the same as for auto-lock time
*Thread Reply:* Okay @NicolasR, I remember that. There is some difference between the MDM setting and local setting for the screen timeout values (and different between iPhone vs iPad)
Can someone explain to me if this is the correct option what I am looking for:
I have to enable a VPN config within Web@Work for testing the WebView deprecation only for pilot users, not for everybody. Every user is using W@W at the moment, so I have to enable the VPN config with Web@Work AND check the option „Per App VPN by Label Only“ so that only my pilot users (which have the label of the VPN config) are affected, not everybody else. Right? I don‘t want that W@W will trigger the VPN for everybody because only the pilot users have the VPN config. Is this the right way?
*Thread Reply:* Great, thank you @Almar Diehl . Wasn’t there a bug if multiple labels are used that a VPN config will remain on the device even though the label was removed? Not sure if this could cause troubles.
*Thread Reply:* if you push both calendar and contacts out to native then why do you have E-mail+ at all ?
*Thread Reply:* yes, for iOS 13+ you can push a profile without Mail and force users to not be able to enable mail. So you can deploy contacts and calendar native sync and/or mails in E-mail+
*Thread Reply:* How do i configure that. Just deselect ‘Email’ from ‘Items to Synchronize’?
*Thread Reply:* should be that easy but I don’t know if your version of MobileIron supports this yet…
*Thread Reply:* As far as I remember it should be released in one of the next Core versions, but it‘s not released yet
*Thread Reply:* Since the core does not support this configuration yet,is there any other means to push this configuration to devices?
*Thread Reply:* Is apple acknowledged this vulnerability.?? I didn't see yet on the apple site..and email+ is free ...??
*Thread Reply:* @Rajesh Kumar https://mobilxperts.slack.com/archives/C1UC210GM/p1588062200091000
*Thread Reply:* For real time notifications you need what we call CNS - Cloud notification service.
To answer @Rajesh Kumar Email+ comes with our Gold bundle which is the most common one for most of our customers
*Thread Reply:* apply rules on server side to only allow specific apps or use sentry ip...if you are distributing email config, stop that (does not seem like u r). You have not provided any info on setup, so hard to say what u can and can not
*Thread Reply:* Sorry, we are distributing mail config and are using Sentry. But blocking server side or just removing the mail config will not be enough because a user might also have configured private mail accounts in the native app. So they really want to totally block or remove the native mail app.
*Thread Reply:* Maybe because mail is not the only app. Comes with Calendar, Contacts, Notes and Reminders
*Thread Reply:* Thanks for the idea Nicolas! Just added all mentioned apps to the App Restrictions. Unfortunately ActiveSync still remains active.
*Thread Reply:* If the customer admin remove the Exchange ActiveSync profile, the corporate account will disappear and it remain available only for personal accounts
*Thread Reply:* Users can not configure it back manually if the Exchange server is behind a Sentry
*Thread Reply:* On Exchange ECP, they can in addition block iPhone and iPad mail clients by leveraging Client Access Rules
*Thread Reply:* This way only other mail clients like Email+, Gmail or Outlook, when configured properly, will be able to sync thru Sentry
*Thread Reply:* Thanks Raul but as said just removing the corporate mailprofile and blocking iOS mail app is not sufficient. If the user has a private mail account configured it is still not safe. For a 100% solution the mail app has to be removed from the devices.
*Thread Reply:* You can use MTD to detect if personal email is used to compromise the device (through can’t detect personal email being detected)
*Thread Reply:* ah, if they also don’t want to allow them to use personal accounts, assuming that the device is supervised, they can leverage app restriction for mail app. (This will make it disappear)
I think it’s too strict as if they are managing supervised devices, the issue is addressed in the beta of iOS 13 so as soon as it’s out in GA, they can force the update
*Thread Reply:* if they are not using Supervised devices, then there’s nothing to do but to pull AS profile and block Exchange
https://www.mobileiron.com/en/blog/mdm-compromise-and-cerberus-malware-attack
*Thread Reply:* Assuming its per app vpn, what is dropping the connection - Proxy, Sentry, remote server or client? Is the connection that drops idle (like a terminal) or active with data periodically flowing and does it re-establish or need manual intervention?
*Thread Reply:* You can remove the proxy from the equation and it still seems to fail. Just having a proxy.pac file specified with rules that say all traffic should go direct causes it to drop eventually. Connection has active traffic, the website in my test lab refreshes every second. Needs manual intervention, the webpage will never physically show a timeout.
As for where the connection is dropping I haven’t been able to determine that. We’ve got MI and Apple involved, was seeing if anyone out there in the broader community uses global proxy and has seen similar issues. Interesting that when I setup perapp with Workspace One and UAG it seems to handle the configuration with no issues.
*Thread Reply:* not supported on CORE (and not planned...)
*Thread Reply:* Registering silently is not on Core
*Thread Reply:* that’s why is better to download the client, and register from there if you are registering without DEP
*Thread Reply:* for example, from https://mac.mi-labs.es
*Thread Reply:* you can upload the app to Core, and deploy it as in-house, but users will be prompted to type credentials in this case
*Thread Reply:* that’s why initiating the registration from client is better
*Thread Reply:* Wait. Mobile@Work for MacOS. Did I miss something? There is an actual installable client for that platform?
*Thread Reply:* Don’t ask me why they named it Mobile@work, but this is being discussed and name will probably change this year
*Thread Reply:* Makes sense / Feature parity with WS1 in how it deploys/executes scripts
*Thread Reply:* So what would be the best approach to deploy an XML file to a certain location on the Mac? macOS Script via Mobile@Work and copy the XML file from another accessible server? I can‘t find that there is a way to deploy an XML from Core otherwise.
*Thread Reply:* If you want to execute scripts without need of M@W client on Core you can use Packages without binary. Just include in the PKG the XML file + the script required to copy it to the right location
*Thread Reply:* PKG need valid signature from dev account, that’s the only downside
*Thread Reply:* Ah gotcha thanks. And deploying apps via AppStore (pkg file) should also work, right? I have uploaded the pkg for Cisco AnyConnect as inhouse app, but it doesn’t get installed on the Mac.
*Thread Reply:* Ran into some issues with the installation of the profile on some of the macbooks. What could be the cause that the installation of the profile fails? Error message: profile installation failed! The profile with the name bla bla could not be installed due to an unexpected error - Internal error:1 - any idea what could be the cause of that?
*Thread Reply:* Ideas: -is an active iCloud account mandatory for an successful installation/enrollment? -Admin account for the profile installation or is a user account sufficient?
*Thread Reply:* iOS AppStore should allow you to get the previous version of M@W
*Thread Reply:* iOS 10 official end of life is in June 2020
*Thread Reply:* How would I get the previous version?
*Thread Reply:* Expected automatically... but not sure, hard to test here
*Thread Reply:* I don’t know if this is On-Premise but I know it can receive AppConfig https://www.keepersecurity.com/en_GB/
*Thread Reply:* and I don’t know if this can scan business cards but worth to ask 🙂 https://marketplace.mobileiron.com/listing/securecontact%20x%20business
In terms of Android Enterprise, is there a way to deploy it without "Location" being enabled? I don't show any specific config values that allow me to disable it per se.
*Thread Reply:* AFAIK there was a change with Android 10 that GPS needs to be enabled in order to successfully apply a profile like WiFi.. correct me if I am wrong. You are on Cloud or Core?
How does one bulk update iOS with mi? I click one at a time and get this window.
*Thread Reply:* Are your devices with are member of that policy supervised and are there updates available for these devices?
*Thread Reply:* why don’t you just block adding any site and map remotely the required ones?
*Thread Reply:* It's just about the trust on the devices... Sectigo (former Comodo) had some issues in the early times anno 2012, but has improved trust on devices significantly. - I am mainly waiting for a let's encrypt integration on Core/Sentrys 🙂 TLS1.3 will make life harder in many unforeseen ways (e.g. renegotiate will be dropped, something Core and Cloud work with intensively). We will get lots of more ports and certificates.... so automation will be key
*Thread Reply:* problem is that Let’s Encrypt CRL is based on OCSP and doesn’t expose any CRL distribution point thru http/https.
If you are leveraging Common Criteria mode, those certs will not work
*Thread Reply:* With Sectigo, the only thing that you have to keep in mind is to get the latest CA chain as it changed recently
*Thread Reply:* Wow this sounds great - totally interested!
*Thread Reply:* I'm interested too.
*Thread Reply:* Import the app and configure it like any other AE managed config
*Thread Reply:* Thanks a lot, will test it this week
*Thread Reply:* @Tobias @Fabian as I’m not an expert on DT hosted platforms, let me know if I missed something or if I can improve something (for example set fixed hostnames for DT Cloud)
*Thread Reply:* At least DT cloud has its own FQDN: https://dt.mdm.telekom.net/ - And it is very likely to not be changed 😉
https://www.youtube.com/watch?v=e72MCV6BiAA
*Thread Reply:* Hey @Mikey2000,
I have an iPad mini 4 registered to Core 10.6, and now I see the outdated OS threat inside M@W
*Thread Reply:* My guess is that today is whn Apple has reported some CVEs that made the current iOS version officially vulnerable as this morning it wasn’t showing anything as you said
*Thread Reply:* Did you deploy an MTD local policy?
*Thread Reply:* Sure because that’s what makes the threat to appear inside M@W
*Thread Reply:* TRM policies will not be shown inside M@W, only local policy threats
*Thread Reply:* Right.. Same on my iPhone 6s - I mean the pending update Maybe I missed something in the local policy then. For Android I have no local policy but it still appears in M@W
*Thread Reply:* you have to enable the Show notification setting on each rule inside MTD LocalActions policy to show the threat inside M@W
*Thread Reply:* Great thanks.. but there is no indication for MTD threats on the device in the admin portal right?
*Thread Reply:* on portal is more for Admins, not for the user
*Thread Reply:* On MTD Console I only enable alerts to be sent to admins,
*Thread Reply:* but the notif sent to users is only triggered from local actions policy
*Thread Reply:* Yes but I mean wouldn’t it be interesting for MDM Admins to see the active threats? But I guess thats what zConsole is for..
*Thread Reply:* yeah, the threat log is only shown on MTD console.
*Thread Reply:* Even if you tie an online remediation action, this will not be very informative for the MDM admin
*Thread Reply:* it’s always better to check MTD console
*Thread Reply:* and configure alerts there to send Threat REports to admins
*Thread Reply:* that’s how I notice if there are any active threats when I’m not inside the MTD console
*Thread Reply:* Yes that sounds about right.. I will thanks 🍺
*Thread Reply:* Can you shed some light into the labels which are needed: -Label(s) for the activation configuration (needs to be applied to the devices -Labels for the compliance groups on Core ( like MTDBlock, MTDQuarantine, etc) - no need to apply these to devices because they will be used if an compliance issue triggers, right -Label for the event settings on Core - like MTD Event Detected - should this label be applied before hand or is it also used if an event is gonna be triggered
Also I guess this labels need to be know or activated in the zConsole, right? On page 21 in the guide it says that labels need to be created before setting up Core with Zimperium, which was not the case.
*Thread Reply:* Perform the integration from MTD console to Core.
Recommendation is to import the iOS and Android labels (both).
On Core, apply the activation config to the labels that you wish. It doesn’t need to be the same labels of iOS and Android.
Then create 2 local actions configs (1 for iOS and 1 for Android) and the phishing config, and apply them to the labels that you wish.
If you also need to use online remediation actions, for example for a chained remediation (I use it for outdated OS threats) then you need to create the compliance actions and so, to reference them in the TRM policy list on MTD console.
*Thread Reply:* For this last part, follow this https://help.mobileiron.com/s/article-detail-page?urlname=Mitigation-and-compliance-via-the-management-console-using-multi-tier-compliance-action-56561773
*Thread Reply:* Thanks - „Recommendation is to import the iOS and Android labels (both).“ you mean the default filter labels?
*Thread Reply:* yup. Import them to the MTD Console when you do the integration
*Thread Reply:* What did I miss if this is unavailabe? (zConsole - Policy - Threat Policy)
*Thread Reply:* You have to select the TRM policy created for each Label imported (iOS and Android)
*Thread Reply:* Ok thanks.. this is very complex 😜
*Thread Reply:* Now it all makes more sense! Thanks! Didn’t see that switch..
*Thread Reply:* You need the Platinum license to use MobileIron Tunnel. Except if you only want to use it for MobileIron productivity apps (D@W, W@W…) for iOS, then the Gold license will do. Note that MobileIron licenses are changing to “Secure UEM” and “Secure UEM Premium”.
*Thread Reply:* Thanks - we configure this VPN configuration for our third party VPN solution, so I guess the platinum feature doesn’t apply here right?
*Thread Reply:* Security policy, device compromised to remediate
*Thread Reply:* Ok, but wich settings will help you to prevent jailbreaks like unc0ver ?
*Thread Reply:* For unc0ver - apple has released patched version 13.5.1.. please request user to update to this version asap.
*Thread Reply:* We have integrated JB/Root detection in both the UEM Clients, but hese will often rely on known signatures. For a better security approach I would advise to use MTD on top of UEM as this will protect also for 0-days and unknown JB like we have seen with uncover. Which was detected actually by both our Client and MTD as it had a known signature.
*Thread Reply:* I see it resolves this Custom VPN issue, but nothing else showing up https://help.mobileiron.com/s/article-detail-page?Id=kA12T000000kACwSAM
*Thread Reply:* The documentation is available including the release notes. https://help.mobileiron.com/s/mil-productdoclistpage?Label=Core&Id=a1s3400000240gaAAA&Name=MobileIron+Core|https://help.mobileiron.com/s/mil-productdoclistpage?Label=Core&Id=a1s3400000240gaAAA&Name=MobileIron+Core
Make sure to select 10.6.0.1 at the top right corner.
*Thread Reply:* I have verified it today and the custom ssl vpn works again
*Thread Reply:* 10.6.0.1 also patches a major security issue...
*Thread Reply:* @Almar Diehl does that same issue exist in 10.4.x? Or just the 10.6 line?
*Thread Reply:* In all versions. There are upgrades / updates from 10.3 and up. But even lower versions than that have the issue, but there is no update for those.
*Thread Reply:* what’s the task you’re doing that requires that?
*Thread Reply:* I guess you mean to keep all admins out of the console, maybe to upgrade Core?
*Thread Reply:* Upgrade of HA environment. Had to be done late at night without modifying the loadbalancer. So prevent users/devices to access to secondary server while we are upgrading the primary.
*Thread Reply:* probably @Jay Robinson & @Daniel Reis are there as well
*Thread Reply:* If the device is on Android 6 or 7 it should work. I’ve registered several
*Thread Reply:* Ah ok thanks.. I thought Zebras can only use StageNow
*Thread Reply:* You can actually send also SN XMLs afterwards from MI
*Thread Reply:* If there’s something you want to do that is not in the UI
*Thread Reply:* And for AE COSU enrollment in Cloud i need only the kiosk policy, right?
*Thread Reply:* Yup. Deploy apps and add those apps to the Kiosk config to see them inside
*Thread Reply:* Is there no AFW enrollment setting like in Core which I need?
*Thread Reply:* You have to ensure to apply the Eork Managed Device config that comes pre-created with the MI Cloud console
*Thread Reply:* By default COPE and DO configs are applied to all androids so change the distribution, and that’s all
*Thread Reply:* For the kiosk, create a Lockdown config of type Work Managed device and enable the kiosk there
*Thread Reply:* Do I have to turn on kiosk like on Core on the device or in the Go app?
*Thread Reply:* You can use StageNow for DO enrollment in AirWatch and SOTI, I’m not sure if that is an option for MI
*Thread Reply:* This is usually my preferred enrollment mechanism for Zebra devices since you don’t have to type anything or tap on Hello There or anything. One scan to bypass the GMS setup wizard and a second scan to connect to wifi, download an agent, install it, set it as DO, and enroll into the EMM server
*Thread Reply:* Yeah, thanks, it’s def supported on MobileIron Core and Cloud.
*Thread Reply:* @Matt Dermody FWIW I've tested AEDO with MobileIron Core from StageNow. Requires a bit of custom intent calling that took a while to figure out, but I've stuck the details here for those coming across this discussion in future! Should also work with MI Cloud https://cwsisecurity.com/resource/project-recap-enrolling-zebra-devices-to-mdm-in-android-enterprise-device-owner-aedo-mode-using-stagenow/
*Thread Reply:* Thanks for sharing @Philip Harrison (CWSI), great stuff!
*Thread Reply:* Fantastic, thanks for sharing!!
*Thread Reply:* Hi @Kiran Patel this article should provide some guidance https://help.mobileiron.com/s/article-detail-page?Id=kA12T000000g0I8SAI
*Thread Reply:* Unless one is supporting a large fleet of devices as used by (pharma/banking) people don't take advantage of API
*Thread Reply:* We leverage them (for there are various APIs currently around) for delivering IronWorks - a MobileIron reporting and dashboard solution - to our customers.
*Thread Reply:* Sorry for the self-promotion plug, but we gather the data daily using these APIs, so seemed relevant here.
*Thread Reply:* We manage about 13000 mobile devices. I run daily python scripts to… • Delete Retired devices from the console after 30 days. • Reset temporary configs i’ve allowed users to opt-in to • Fix odd stuff until official fixes come through (i.e. Ownership settings etc). • Supplement complex deployments (i.e. Removal of Native mail config when exchange last sync is more than 7 days)
*Thread Reply:* I can’t wait to see new Arm-based Mac hardware myself. 🙂
*Thread Reply:* that definitely will open the app developers to more possibilities for their apps..more wider user base. Apple seems to be going BIG for the enterprise market now
*Thread Reply:* Hmm, not convinced their enterprise approach is quite there though. It is hard to interweave a Mac laptop into a MSFT ecosystem, and Apple’s support for alternative services is woeful - DNS, web, email and similar services are no longer supported/shipped, for example.
*Thread Reply:* I’ve always felt as if there had been a clause in the MSFT loan to Apple back in the day that prevented them from competing on the enterprise desktop/server space. Apple’s approach has always been piecemeal there, even by MSFT standards.
*Thread Reply:* I think and this is just my personal opinion that Apple has struggled to get developers to enterprise for Macs..and till date the Win7 to Mac issue haunts Apple from progressing in enterprise
*Thread Reply:* There is an underlying acceptance in the air about Microsoft being THE productivity suite..that is why they showed office on new silicon
*Thread Reply:* I'm pumped about ScreenTime on tvOS. Not for enterprise so much, but for the household 🙂
*Thread Reply:* Did you define a password in the paramters.json ?
*Thread Reply:* Then you should be way to go as the default Security Group allows SSH over port 22, and the default password is defined in the json file before to start the procedure of creating the blob
*Thread Reply:* We found a solution, seems to be a bug in the 9.8.1 VHD. Re-installed with a 9.7.1 VHD and that works fine.
*Thread Reply:* Do you mean to use whitelist and blacklist features?
*Thread Reply:* I only allow internal traffic on AE managed Chrome
*Thread Reply:* Yes @Raul! We pretty much prefer Chrome around these parts, so wanting to deploy to iOS and lock it down similar to that of Safari
*Thread Reply:* ah, but on iOS there’s no managed config for Chrome, sorry for the confusiom
*Thread Reply:* Ah, darn! I was thinking I had come across at least a couple managed configs for Chrome on iOS in the past.
*Thread Reply:* Uploading an APK directly to Core is intended only for DO mode devices and will not allow you to configure it.
What you should do, once that you have the AE bind configured to deploy AE, is:
Go to Apps catalog and do like you to import a public app. This will open iFrame.
At the left you will see a pane where you can choose between public apps, private apps or web apps.
*Thread Reply:* Choose Private app and hit the coloured + button to upload you private apk
*Thread Reply:* it will be published and later you will be able to handle it like you do for public apps.
*Thread Reply:* this method will make app available for all 3 AE deployment methods
*Thread Reply:* Righteous. Thank you so much @Raul! 👏:skintone2:
*Thread Reply:* @Raul after it goes Pending, do I need to stay on this screen?
*Thread Reply:* Disregard. Looks like it remains in that iFrame from Google even if I leave/return
*Thread Reply:* The json file you get from Core when you upload an apk directly is intended for self hosted deployment, and requires a paid developer account, but you don’t need that to deploy regular private apps.
*Thread Reply:* Just follow the guidelines I shared on the other comment
Anyone familiar with this one? Looks like a firewall issue:
*Thread Reply:* It is likely firewall related but have seen a few times when the token is corrupted and just going through the process once more with a new token seems to work.
*Thread Reply:* I cannot find anything being blocked from the Firewall. DEP service within Core has the status success! Tried three times with a new token, same error!
*Thread Reply:* Is there a proxy with SSL offloading? This lead to a similar issue for a customer.
*Thread Reply:* Thanks for the input @Nico Hermeling - no we have no proxy. Have to find the logs on Core to get more info on this.
*Thread Reply:* maybe wrong token (DEP, Wrong account on refresh)?
*Thread Reply:* Turned out to be a browser issue! Chrome destroyed the token. No issue with on of the others and it worked!
*Thread Reply:* This is a request for Samsung as they need to support modern auth to be configured remotely
*Thread Reply:* AFAIK they only support Basic and Kerberos
*Thread Reply:* There’s no managed config exposed to configure Oauth
*Thread Reply:* That is what i thought.. damn
*Thread Reply:* just an FYI it would seem Samsung email does support this now via Managed Config.. see attached image...
*Thread Reply:* Ok interesting.. but we use Exchange On-Premise. Do we also need Modern Auth?
*Thread Reply:* Scratch that.. Access is not relevant for Exchange On-Prem with Sentry anyway, right? As long as we do not migrate to O365 we are safe right?
*Thread Reply:* It was not available, but as @Ajay Patel mentions, it was added recently! Good find, thanks
*Thread Reply:* You can also configure Exchange On-Premise to use Modern Auth, but normally you only do it when going hybrid
*Thread Reply:* AFAIK you need at least 1 account on O365 to do so, and that’s automatically a hybrid environment
*Thread Reply:* When using Exchange + Sentry you can use KCD which is the best experience for on-premise mail
*Thread Reply:* unless you use Outlook for sure, that doesn’t support KCD
*Thread Reply:* Indeed, modern auth for on-premise Exchange only exists when your exchange is hybrid: configured to interact with Exchange Online. No need for an actual mailbox on EOL yet. https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview
*Thread Reply:* Core does not store any password or hash of password. Authentication happens with AD
*Thread Reply:* And what is the feature „save user password“ on Core?
*Thread Reply:* Ah, yes, that feature is there.
*Thread Reply:* This is what I could find : To get the new password synced to Core, we should go to Core > Users > Resync LDAP (make sure you turn off the LDAP Discard % in the LDAP-preferences)
*Thread Reply:* This is to force a sync or you will have to wait for your sync to happen
*Thread Reply:* Ok right thanks. Since this is a manual resync this is impossible to schedule because I would never know when a user changed his password. But thanks for the hint!
*Thread Reply:* But I believe it is also possible that Azure is not aware of the new password if the AAD Sync didn’t happen
*Thread Reply:* Possible. Passthrough authentication from AzureAD solves this latency issue
*Thread Reply:* Save Password is intended to save the password typed during registration
*Thread Reply:* It’s not good as when it changes on AD, if user don’t log in to Core SS, the stored password doesn’t change
*Thread Reply:* If you have Exchange Online, I recommend you to give CBA a try
*Thread Reply:* It will not be killed by MS, and works like a charm since 2016
*Thread Reply:* If you want to force AAD to check cert CRL, and you’re not using Core as CA, you will need to expose the CRL to internet
*Thread Reply:* Great input! Thank you Raul!
*Thread Reply:* Best approach is to use Core as standalone CA or to turn it into a intermediate CA from your internal CA
*Thread Reply:* This way Core will expose the CRL for you
*Thread Reply:* Checking CRL is not mandatory anyway
*Thread Reply:* MI Access can be leveraged and will cover Exchange and also the rest of O365 apps, while CBA is only useful for Exchange Online, so keep that in mind
*Thread Reply:* @Raul do you know how to stop exchange online CRL checking? Have tried to find it, but no luck
*Thread Reply:* It depends on how you leveraged the PS1 commands
*Thread Reply:* New-AzureADTrustedCertificateAuthority -CertificateAuthorityInformation is the command I used. Which paramater will stop CRL checking?
*Thread Reply:* Not so far I’m aware, what are you looking for?
*Thread Reply:* @NicolasR I was looking for the Gooogle reauth feature
*Thread Reply:* Feature or issue with reauth? Assuming you are referring to Google managed play reauth?
*Thread Reply:* there was an issue on CORE where we introduced manual re-auth request for Managed Google play for troubleshooting purposes. Not sure Cloud is affected at all from this, haven’t checked
*Thread Reply:* I was looking for Google Play reauth because some user are facing issue when using user based account. Changing to device base account resolve the issue but the user have to reenroll.
*Thread Reply:* @Florent N. You should contact support for this. The re-auth that you are talking about should happen silently.
*Thread Reply:* Also, there was something that only our support team could trigger for user>device account, as we did not want this to be done for all customers. I will leave it at that.
*Thread Reply:* if the app is really managed and the XML gets applied, I think its an syntax problem im xml or a bug in the app
*Thread Reply:* Did you checked the setting to use a plist instead of managed config, inside iOS app properties?
*Thread Reply:* @Raul not sure if I can follow you. Within the AppCatalog when I click on edit on the app there is not really a lot to configure and also no option to use a plist instead of a managed config - this is what you mean right? Would that mean that the app doesn’t support managed app configs? Just checked the option within Cisco Jabber, I can see the option there!
Uploading the managed config, is the file extension important? Like .plist or .xml?
*Thread Reply:* @Wolfgang Bauer thanks, yes the app is managed - checked that in the appcatalog..
*Thread Reply:* I’ve found that this setting only appears when the app accepts managed config so maybe that’s a different story
*Thread Reply:* We currently use Munki and are evaluating MobileIron’s software delivery capabilities. One thing we would like to do is package and deliver a single file but MI doesn’t appear to be able to do this. It reports that it has installed it, but the package is nowhere to be found.
*Thread Reply:* Are you doing anything like this?
*Thread Reply:* Hey @Jay Robinson curious about the use case, as delivering as multiple files will also allow more granularity
*Thread Reply:* Hi @NicolasR, I work with Jay… the specific use case that brought this on goes like this. I want to place an executable in a location on the machine, that can be activated at a later date via the scripting tool in Mobile@work. When I package the executable file and deploy via munki---no problems at all. When I deploy the same package with MI, the file does not show up. I have tried a traditional package, a package created using the MI packaging tool, and signed and unsigned versions of each. With each deployment, Mobileiron says that the “app”[package] has been installed, but the executable is not present
*Thread Reply:* Also looking for the ability cache packages like I can using the “precache” key in munki
*Thread Reply:* @Tohsheen ☝️This looks like something we can do but not sure, can you have a look?
*Thread Reply:* @Jay Robinson @CJFrickle - lets talk about this on a call. ~I will shoot you an email about this
*Thread Reply:* You can do depending on your ADFS version
*Thread Reply:* ADFS 3 or 4--> limit the claims providers that each Relaying Party Trust can use, and allow Access only on the one you want to be sanctioned.
ADFS 4+ only --> You can apply the webtheme only to the RPT that will be sanctioned
*Thread Reply:* What would you recommend before executing the PS script on the ADFS - Snapshot, Backup or else, what is sufficient in case something went wrong.. not really to familiar with ADFS yet.
*Thread Reply:* When you talk about ADFS + Access as Del-IdP, rolling back is as easy as setting the default webtheme active again.
*Thread Reply:* so add a ps1 file with the cmdlet to set the default webtheme, and you will be fine
*Thread Reply:* You can take a snapshot, but as the code that change the traffic is contained in the custom webtheme that you are applying, rolling back is simply a powershell script
*Thread Reply:* APNS capable means that they are capable to receive APNS push messages inside the M@W client (different than MDM APNS). Users that have not launched M@W once are the ones that appear under APNS capable false.
By default users have 4hours to open the client but since Core 10.5 you can change the value in the UI.
Downside: no client check-in (different from MDM check-in) and nor Jailbreak detection/MTD activation
*Thread Reply:* So for all users who have not openend M@W within the 4h, they will have to open M@W and newly register? Is that even possible if the MDM profile is already installed? Or do we have to retire the device and re-enroll?
*Thread Reply:* Just delete Mobile@Work client and re-download it to get a new “window” (with the new TTL of the nonce token)
*Thread Reply:* **the download must be done from apps@work
*Thread Reply:* Ah ok.. so need to install a new profile? Because we block manual profile installation
*Thread Reply:* Neat trick for DEP (supervised) devices is to hide other apps except M@W / use homescreen layout / change wallpaper (with a message) after enrollment to force users to open the app. You can create dynamic label based on client check-in / APNs capable flag etc. to disable that dumb mode automatically after successfull client check-in.
*Thread Reply:* but that solution doesn’t really scale from customer reports: Label calculation may take up to 2/3 hours.... 😢
Anyone familiar with this error on Core? Some VPP apps will not install on the device:
*Thread Reply:* Is the app still there in store? Does the VPP Sync work on other apps?
*Thread Reply:* Yes it is Mobile@Work. VPP sync works.. Other VPP apps are getting installed!
*Thread Reply:* bought enough copies of it in ABM? do you have multipe mdms in one ABM location?
*Thread Reply:* Yes plenty 500 licenses, only 2 devices at the moment. No, only one MDM
*Thread Reply:* try to delete mobile@work in core if only two devices and readd it (maby select the correct country before search in core) and then refresh VPP token and try agian
*Thread Reply:* We have 2000 devices which are not DEP enrolled. So they already have M@W deployed via the Default iOS Label. So I can‘t delete it that easy. We are in the process of migrating devices to DEP. So the first step would be to get a rid of the iOS label. Having the iOS label (no VPP) and a new label for DEP devices (VPP enabled) on the same app - maybe that is the problem.
*Thread Reply:* ah ok, hmm then maybe only token refreh and resync
*Thread Reply:* Most of the devices are on the watchlist for these 3 system configs. I am sure this is related to the policy violations event „iOS configuration not compliant“ right? Looks like an Update issue
*Thread Reply:* Please raise support case... this kind of things can create a lot of subsequent issues
*Thread Reply:* Right I will, thanks But how can I find details in the event and what triggered the event? There is not really helpful info in the event
*Thread Reply:* The security event code is not publicly communication for security reasons
*Thread Reply:* You can have the detail in plain text I think
*Thread Reply:* Somewhere in the device details but I don’t expect this to be related
*Thread Reply:* Ok thanks. It would be great if you could create a event template with more details. But not really a lot of variables which can print out more info.
*Thread Reply:* There are no MDM payloads for watchOS, except for some iOS restrictions that you set for iPhones. As long as there is no MDM endpoint, there is not much any vendor can do to support it.
*Thread Reply:* Yes, what @Mark Vonk said. Some of the policies for phone trickle-down to Watch. So at least we have that going 🙂
*Thread Reply:* @Mikey2000 Do you have other O365 products in use with Access? Can't say I've yet seen a cookbook specific to Teams.
*Thread Reply:* Yes, iOS and Android Enterprise
*Thread Reply:* Android Enterprise works strait out of the box, some quirks with split tunneling on iOS.
*Thread Reply:* There is no cookbook for Teams specifically. Use the cookbook for ADFS and Office365 instead. Assuming you have ADFS of course. There are no cookbooks on individual Office365 apps, just Office365 in general, which includes Teams, but all other Office365 apps too. So others like EOL, Sharepoint, etc will be dealt by Access too.
We had an issue before with Teams not working combined with Access. To fix that we had to enable forms based authentication for Teams.
Has anyone seen this - can‘t see any new updates on Sentry 9.8.1 and if I click check updates I receive this errors:
*Thread Reply:* To which version are you expecting to upgrade? Since you are on 9.8.1 there are no upgrades. There is a 9.8.5 but that is not a version you can upgrade to, only fresh install.
*Thread Reply:* Ahhh ok! That explains it! 🤣 thanks
*Thread Reply:* Do you have an Homescreen layout setting?
*Thread Reply:* Ah yes I have.. Is that gonna bite me in the a$$?
*Thread Reply:* If users install private apps they should be able to delete them
*Thread Reply:* yes thats your problem, i think
*Thread Reply:* They can do from Device Settings / IPhone or iPad Storage but I agree on this is not good experience
*Thread Reply:* Good point, I didn’t know that - thanks 🙏
*Thread Reply:* So the Beta option in the label is only visible when a developer adds our organizations ID within a Beta channel on GooglePlay?
*Thread Reply:* Yes indeed, the devs adds your orgID. Then, after some time (could take some hours, up to a day), the alpha and beta channels show up.
*Thread Reply:* You need to create a QR code for every single device registration and make it available to the end user. A collegue has created code that can be added to the enrollment template to automatically add a QR code to the registration mail and on screen info.
*Thread Reply:* This sounds very interesting. So basically all the relevant info for enrollment needs to be in the QR code like userid or email, PIN or password.. Is your colleague using Web API call for this? This sounds great.
*Thread Reply:* Yes, I Will post the code later on.
*Thread Reply:* Thank you - you’re the best! 👍
*Thread Reply:* Ah, even better, MobileIron added the solution my colleague came up with to this Knowledge item.
https://help.mobileiron.com/s/article-detail-page?Id=kA12T000000TSDVSA4
Extract:
Implementing infrastructure for QR code with device PIN The below procedure works for iOS devices and utilizes the PIN code as part of the registration. 1. Enable the PIN code registration
- Go to Settings > Users & Devices > Device Registration.
- Change the In-App registration requirement to Registration PIN. 2. Enable the QR code integration
- Go to Settings > Users & Devices > Device Registration.
- Click on Templates tab > Registration Templates.
- Select your language and then click the Edit button.
- In the Registration Email section, PIN field, replace the default text with this code:
- <li>Registration PIN: <i>$PASSCODE$</i> (valid for $PASSCODE_TTL$ hours)
- <p>
- Or Scan the QR Code:
- </p>
- <P>
- <img id='barcode'
- src=“https://api.qrserver.com/v1/create-qr-code/?data=mirp%3A%2F%2F$SERVER_URL$%26user%3D$USER_ID$%26pin%3D$PASSCODE$”
- width=“200"
- height=“200” />
- </P>
- Click Save.
- When this code has been added, administrators can directly register a device from the Device Registration screen in Core and / or the device user can initiate the registration from the e-mail invitation.
*Thread Reply:* 2020 is getting better every day 😜👏👏👍👍
*Thread Reply:* The part with mirp://.. confuses me.. we still need a webpage?
*Thread Reply:* No, mirp is the schema used by the Mobile@Work cliënt. So the URL opens the M@W cliënt and adds the data supplied in the URL to the registration fields.
*Thread Reply:* Gotcha... have to try this tomorrow! Thanks!
*Thread Reply:* Works like a charm. Is this also included in the M@W for Android?
*Thread Reply:* Got it, is also in M@W for Android and works fine!
*Thread Reply:* Yes. You will need to “view” the Sentry certificate from Core as it makes Core aware of the new cert. copy/paste the cert in the tunnel config and save to get a repush. Until the device gets the new tunnel config, it will fail to connect due to the mismatched certs. You could indeed disable pinning. But if the goal is to have certificate pinning enabled, I would not bother as it means you will have to repush the config multiple times.
*Thread Reply:* Yes had already the pleasure of troubleshooting this!
*Thread Reply:* We have KCD working in W@W and D@W with WkWebView. However, without the SCEP renewal (so users have to enter their password once a day).
Hard to supply screenshot due to the nature of the company, so if you can supply your screenshots I can compare them.
*Thread Reply:* Ok that would be fine. If you find some time could you share your configs? It is not working at all for us and I compared the configs with MobileIron Docs but was not able to find the error.
*Thread Reply:* I edited my reply (hit the enter button to soon). Hard to supply screenshots.
*Thread Reply:* Everything is attached to the same label
*Thread Reply:* I think your SSO config is wrong. In the username field you have $USERID$, this should the kerberos principal name.
*Thread Reply:* You mean NT principal instead of the userid?
*Thread Reply:* No, I mean the actual name of the account that has been created that has the right to fetch the kerberos ticket on behalf of the user.
*Thread Reply:* Sorry, I was looking at a wrong, not working, configuration in the test-environment. $USERID$ is correct. But in your SCEP configuration I see that you use $USER_UPN$ for the Subject Alternative Names. According to the documentation this should be $EMAIL$.
*Thread Reply:* B.t.w. since you are using a local CA, is this CA ‘known’ by your AD servers?
If Local CA: • Requires trust between MI local CA and KDC • Follow directions in below KB entitled How to force KDC to trust local CA: • https://help.mobileiron.com/s/article-detail-page?Id=kA12T000000TUMpSAO
*Thread Reply:* Core was integrated as a SubCA within our Microsoft PKI
*Thread Reply:* In your SSO config, set the Identity Certificate to None for testing purposes. You should then just be prompted for your password. And otherwise, enable level 3 or 4 logging on the Sentry server and see if there are any errors there.
*Thread Reply:* Good point, thanks! I will give it a try and keep you posted.
Bloomberg reporting that MobileIron possibly going up for sale: https://www.bloomberg.com/news/articles/2020-08-20/software-company-mobileiron-is-said-to-explore-potential-sale
*Thread Reply:* This is interesting... or frightening.. not sure yet!
Third party MDMs can soon be used with Intune and Conditional Access - currently only WS1 in the list. Can anyone tell me when this is coming for MobileIron Core?
*Thread Reply:* It’s unfortunate that MS essentially paywalled the old API - in any case, Core is expected to have this very very soon. Chat to your account rep if you want to enquire about the beta
*Thread Reply:* Core 10.8 should be released in the second week of September. Not sure if this feature was implemented though
*Thread Reply:* You have to share the apps uploaded to dev account with iFrame account Google Enterprise ID.
*Thread Reply:* You mean upload the APK again? But the package name will exist within Google Play already
*Thread Reply:* No you’ll have to assign it from one to the other via the Org ID
*Thread Reply:* it will still be primarily housed in the original location but you will be able to have visibility to it through the iFrame once it is shared with the org ID associated with that iFrame
*Thread Reply:* https://arsenb.wordpress.com/2020/07/01/how-to-publish-an-app-to-customers-managed-play-store-with-android-enterprise/
*Thread Reply:* arsen covers this process fairly well
*Thread Reply:* Ah wow thanks I will look into that
*Thread Reply:* this is a known issue at Core. make little groups or use mail notification instead.
*Thread Reply:* Ok, thank you, we will split the messages into smaller groups, then....
*Thread Reply:* @Wolfgang Bauer is there a Issue number or something we can refer to to get this issue fixed? Or just something learned from experience 😉
*Thread Reply:* its an known issue by asking MI. I dont have an Issue ID and dont know an KB article. Open an Ticket 😉
*Thread Reply:* Will do that, that´s why I asked...:-)
Anyone seen the new Gartner Magic Quadrant? MI dropped out of the leaders! Thoughts?
*Thread Reply:* Ok I’ll start.. Sure this might be related mostly because of Windows 10, which is not huge with MobileIron. But this will make it hard or even impossible to make the argument that MobileIron is way more superior than Intune, which I still believe is the case in so many ways! You may think what you want about Gartner, but I believe this is pretty much the first nail in the coffin for every admin who is fighting the war on the field day by day preventing migrations from MobileIron to Intune.
*Thread Reply:* Its the magic quadrant of windows management. They reframed the criteria (towards windows management). So there are only a few vendors in the race. the only way to keep the quadrant was to shift positions, which was done bad I think..
*Thread Reply:* Hi, Gartner have added a lot of weight to VDI scenarios where Microsoft and VMware are strong and where Mobileiron have nothing at the moment. This is one of the biggest reason why we are here.
- legacy Windows 7 management is more important than expected
*Thread Reply:* Also this year due to COVID-19 Gartner didn’t took feedback from customers like other times, which was a big miss in our case as our customers are our best asset 😍 (proof point is Gartner peer insight)
*Thread Reply:* This quadrant is weighted very heavily on VDI and Windows 10. It doesn’t reference Intune specifically, rather MEM and the data should be taken as such. I see a lot of spruikers on LinkedIn talking about their amazing foresight, when they’re basically asleep at the wheel and can be replaced by any other mindless MSP that recommends MS without taking into consideration business requirements, as demonstrated by their lack of understanding (or wilful misrepresentation) of this data. Neither product is better or worse than it was prior to the quadrant announcement and as usual, make a business case and measure requirements before making a decision.
*Thread Reply:* If you require your users to change the passcode every x days you can use the following filter:
"common.platform" = "Android" AND "android.prvpasswordexpiration_timeout" = null
*Thread Reply:* The problem is we had an issue with a label so a lot of devices didn’t receive the security policy where a passcode was enforced. They received the default security policy with optional passcode. So we just want to know how many devices have no passcode set!
*Thread Reply:* When there’s no passcode, encryption is disabled
*Thread Reply:* so you can use that attribute on filter
*Thread Reply:* This is also the case for Android device admin and Android Enterprise?
*Thread Reply:* Most modern Android devices have encryption enabled out of the box.
Hello, will Web@Work be available for AE ?
*Thread Reply:* W@W is not available for AE, MI decided to use chrome instead as essentially almost everything that you could do with W@W can be achieved with Chrome and AppConfig.
*Thread Reply:* Hello Mathieu, I was just wondering if it was newly added to AE because the screenshot said that it is available on the Google Play
*Thread Reply:* If you just need to replace AppTunnel to Tunnel to Connect, then you don’t need to add a cert to authenticate to Sentry.
*Thread Reply:* So just apply per-app VPN, add the KVP and apply iOS SSO
*Thread Reply:* Then you will have the same passwordless experience and connectivity
*Thread Reply:* For the connectivity, Tunnel will present its own cert in order to connect to Sentry
*Thread Reply:* Thanks Raul! Yes that is exactly how my configuration looks, but I Still have some difficulties with this - SSO won’t work.
*Thread Reply:* Will have to look deeper into this
*Thread Reply:* No rules within the W@W config would tunnel everything thru sentry right?
*Thread Reply:* I have enabled the VPN within the W@W app to trigger, but I don‘t see the VPN sign like I do with safari
*Thread Reply:* ah, because you have to send a command to reinstall the app on all devices so the Per-App VPN flag is applied. It’s only added during app installation.
Hey does that get triggered for users on MobileIron Core?
*Thread Reply:* Oh really.. someone must have chosen this wrong. Any chance I can find out quickly which app was chosen for user based VPP without going through every app?
*Thread Reply:* apart from browsing the database I don’t think
*Thread Reply:* Yeah, I don’t know if it will prompt you to accept it for each app that is set as User Based
*Thread Reply:* We are still receiving prompts on a lot of devices even though we found the app that caused it and changed it to device-based license. Any caches we need to clean?
*Thread Reply:* probably that you have another app in that config
*Thread Reply:* We went through every app, everything device-based. But we have a couple of apps in different device spaces - maybe there is a mismatch
*Thread Reply:* I think iOS 14 has some enhancements to triggering per-app VPN; would you happen to have tested in 14?
*Thread Reply:* A feature request is opened but no real progress for now, don’t expect 2020: PREQS-452
*Thread Reply:* feel free to reach PMs about that 🙂
If this is enabled a user cannot add and remove accounts - for Work Profile that means that a user cannot add accounts within the work profile, right? Within the private profile he still can, right? (MobileIron Core)
*Thread Reply:* Just recorded on my device (sorry it’s in French)
*Thread Reply:* Otherwise more official videos are here
https://www.youtube.com/c/mobileiron
*Thread Reply:* Thanks, great videos! Can MTD als help with use case that a virus scanner would do, like if a user opens an attachment on the device which contains a threat or if the user wants to store that attachment on the device?
*Thread Reply:* i would say, yes. I am not a MTD expert
*Thread Reply:* VIrus scanners are comparing files based on their hashes. Having a malicious app or a doc containing weird code does not pose a risk per se. Based on the fact that depending on the platform filesystem based scans can not be performed due to lack of permissions and/or sandboxing concepts, such scans simply can not happen because of this limitation. MTD uses AI trained engines to detect anormal behavior on the device compared against expected normal behavior.
*Thread Reply:* Yes, that makes sense. I think i assumed someone was executing malware sourced from a file
*Thread Reply:* They were pushed to 9/21 as far as I remember
*Thread Reply:* So not today? On september 21?
*Thread Reply:* confirmed that this is the current plan
*Thread Reply:* <minor rant> I wish people would use dd/mm by default, or failing that, the ISO standard of yyyy/mm/dd … </minor rant> 🙂
*Thread Reply:* Still no new version. What’s going on?
Can anyone tell me how the XML file should look like with a Managed App Config for iOS? (MI Core)
*Thread Reply:* Something like:
<managedAppConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <version>1</version> <bundleId>com.adobe.Adobe-Reader</bundleId>
*Thread Reply:* Thanks.. I used a key tag for this..
*Thread Reply:* Thanks, worked like a charm thanks to your hint
*Thread Reply:* Of course with Sentry, right? Is there a documentation for this?
*Thread Reply:* Because ENS states O365 is not supported
*Thread Reply:* In test (4 Cores in total) it is working fine. No production upgrades yet though.
*Thread Reply:* Some hundred Cores upgraded to 10.8 - No issues yet
Microsoft Tunnel? Wow, very intuitive name! Sounds like copyright infringement to me 🤣
*Thread Reply:* https://www.vmware.com/products/workspace-one/access.html
*Thread Reply:* Since we need a Linux server to run MS Tunnel, could we install MS Tunnel on a MI Sentry server 😂
*Thread Reply:* How much longer before MobileIron takes them to court for copyright infringement, anti-competitive practices and patent infringements?
*Thread Reply:* They also copied MobileIron Rooms! https://techcommunity.microsoft.com/t5/exchange-team-blog/book-a-workspace-in-outlook/ba-p/1524560 #onlyDinausorsKnow 😎
*Thread Reply:* MI Rooms is still available?
*Thread Reply:* WS1 Tunnel, MI Tunnel, MS Tunnel. Its a synonym for VPN these days
*Thread Reply:* As long as they don’t call it Microsoft MobileIron Tunnel..
*Thread Reply:* WS1 changed the product name to Tunnel long time after MI released the product.
*Thread Reply:* Well this just sucks.. thanks!
*Thread Reply:* It sure does suck. And it can get worse because there are ideas of lowering the lifetime to 98 days.
*Thread Reply:* But this does not affect user certificate that we use for KCD right?
*Thread Reply:* But then again, those would be the ones that are easy to (automatically) renew.
So, MobileIron was bought by Ivanti. Not sure what to think of this! 🤔
https://www.mobileiron.com/en/company/press-room/press-releases/mobileiron-to-be-acquired-by-ivanti
*Thread Reply:* Interesting that PulseSecure was also picked up. Ivanti looking to build a suite of endpoint management, security, and connectivity. Makes sense as thats where WS1, Symantec, Microsoft etc are all going
*Thread Reply:* Initial thoughts: I like the Pulse Secure co-acquisition, there’s a lot of strength in that approach, which could lead to a great combination in many customer deployments.
*Thread Reply:* My most immediate questions would be around Ivanti’s previous track record in their earlier acquisitions, their go-to-market model, and their planned execution of their vision.
*Thread Reply:* Agreed, Ivanti is definitely trying to build up a strong offering, but will need a strong execution.
*Thread Reply:* I think MobileIron's suite of offerings will make a nice pairing with what Ivanti is bringing to the table. As much as I hate to say it, I've felt that things plateaued after the release of Access. Here's hoping the relationship jives and takes things to the next level for everyone involved!
*Thread Reply:* The interesting part is how and if this will affect current MobileIron licenses in terms of features - and vice versa. And it also might be the case that the brand name „MobileIron“ will disappear - would do you think?
*Thread Reply:* @Mikey2000 My guess that they just absorb everything and leave it as-is (perhaps for 1-2 years). Then start to rebrand/re-align/etc
*Thread Reply:* forget about KCD, iOS doesn’t support UIWebView anymore which allowed us to do KCD. Use iOS SSO payload with Kerberos
*Thread Reply:* For CIFS and for SharePoint when FBA and webview is disabled, KCD still works
*Thread Reply:* this way you will ensure that Go only prompts for username, and then redirection happens
*Thread Reply:* Thank you, good to know
*Thread Reply:* It’s the same as when using an IdP to login to MI Cloud
https://oddytee.wordpress.com/2018/06/11/attributes-change-for-an-ad-user-a-mailbox-is-moved-to-exo/
*Thread Reply:* @Peter Mohr Using a MI Core that has users on multiple M365 tenants, I'm working on a similar label to selectively apply a mail config to users whose mailboxes have migrated. I see that the values you listed are in this article: https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_exchon-mso_o365b/recipient-type-values/7c2620e5-9870-48ba-b5c2-7772c739c651 My concern is that I would need the MI label to ascertain both that the user's mailbox has migrated, and to which tenant. So rhetorically, I'm wondering if I need to combine msExchRecipientTypeDetails and targetAddress.
*Thread Reply:* Why do you care about tenants? For mail and app configure it’s all the same for all tenants
*Thread Reply:* Agreed that in most cases, it would be. But I'm afraid that in this case, the M365 tenant destinations are not the same.
*Thread Reply:* But I guess that gets too complicated. Simpler question: Do you mean that you used msExchRecipientTypeDetails in your MI labels?
FYI // This is being addressed in Core HotFix 10.8.0.0a
}
Excuse me, but am I the only one? I don’t get it! Is that supposed to be funny or rather serious?
*Thread Reply:* Yes that would be my guess too! And I like your word association - Avanti! 🤣
*Thread Reply:* Gartner gave a lot of importance to areas like old client management and VDI this year
*Thread Reply:* MI don’t provide those features, hence the movement
*Thread Reply:* Check Forrester Wave Quadrant to find what I mean
*Thread Reply:* if you see 8080 this means this Core was built a long time ago
*Thread Reply:* You can change that port from MICS portal / Settings / Port Settings
*Thread Reply:* Right, I see the same option like you posted. Core was built a long time ago. How can I verify if we still use 8080 or 443? I see 8080 only with the CRL
*Thread Reply:* And changing the CRL from 8080 to 443, any impact for devices. I guess local CAs will renew certificates?
*Thread Reply:* a CRL on HTTPS doesn’t really makes sense because you need to check another CRL to verify your CRL...
*Thread Reply:* Right.. but to use 8080 was flagged as a security risk by an audit company.
*Thread Reply:* Found that: http://rikka.se/?q=node/12
*Thread Reply:* At the moment you can leverage PIN + Password, which is MFA.
*Thread Reply:* If you want to use your IdP and leverage its own MFA, that’s what will eventually be available
*Thread Reply:* @mahiroux We front-end our Core with BYODPortal, which is tied to our Okta (which employs MFA). We enforce PIN at the Core, so no one circumvents the BYODPortal enrollment workflow.
*Thread Reply:* you can also federate the CORE user portal with an IDP, no more need to have BYODPortal (which hopefully will be soon EOL...)
*Thread Reply:* I had a couple of similar issues and it was often due to Firewall timeouts
Important thing to understand is that the Session TCP keepalive timeout must increase or be equal from Exchange CAS server to the device
i.e: Exchange CAS: 15Minutes CAS Load balancer: 30minutes Sentry: (not configurable) 60minutes Sentry LB: 60minutes Edge Firewall: 60minutes
THIS IS SUPER IMPORTANT!! It can lead to Mailbox re-sync and very akward issues 😉 Everything is explained in the MobileIron & Microsoft KBs
*Thread Reply:* Well explained here: http://ilantz.com/2013/01/14/tcpip-keepalive-session-timeout-rpc-timeout-exchange-outlook-and-you/ And here: https://help.mobileiron.com/s/article-detail-page?Id=kA134000000QxzMCAS
*Thread Reply:* Whoops wrong product :) deleted my message
*Thread Reply:* I do not think so. You can try though, with the same commands as for the Core and Sentry. In VMware on the connector click Install VMTools. Go to the CLI and perform a “install rpm cdrom”
*Thread Reply:* @Mark Vonk yeah, unfortunately I don't see the ability to invoke the install rpm command. Can't say I didn't explore all the options 🙂
*Thread Reply:* Just checked it: you need to register a support case to get a devshell password. See: https://help.mobileiron.com/s/article-detail-page?Id=kA134000000QxoFCAS
As there is no service support (one time password for misupport)
After you get that you can install the VMware tools using regular Linux commands
*Thread Reply:* @Mark Vonk yeah, I was looking for the service support option. Use that all the time on the Cores
*Thread Reply:* But I can combine MobileIron Access and Cisco VPN in one Tunnel config?
*Thread Reply:* Not possible afaik. Using Access requires Tunnel. You should really look into why you need another VPN, because Tunnel already offers you VPN capabilities
*Thread Reply:* Mostly it is because we don’t have the platinum license to use Tunnel 😜
Meant to share that I received closure on this one. When the changes were made at the top level of the GSuite tenant to no longer require the Google Device Policy app.. it relaxed on all OUs.. except ones that had been customized. Said user was in an OU that still required the Google Device Policy app, hence why it wasn't allowing things to move forward. The second we corrected the setting on the OU, the Google Account added and we were back in business.
*Thread Reply:* If there is no plugin yet, maybe you can try to modify my plugin for Centreon https://github.com/nosari20/centreon-mobileiron-plugin
on Core.
*Thread Reply:* You can add a WebApp in the Google Play iFrame.
*Thread Reply:* and works on All AE modes, not only on DO mode
*Thread Reply:* Thank you @Raul and @Almar Diehl!
*Thread Reply:* So will the shortcut call and open the URL in Chrome directly or do a browser window (like a full screen web app)?
*Thread Reply:* you can choose the behaviour, but chrome have to be installed
*Thread Reply:* That’s fine @Raul. I’ve already got Chrome installed/allowed (using managed config with homepage and bookmark entries)
*Thread Reply:* ??.
It’s just a matter of creating the VM and attaching the ISO, like on ESX
*Thread Reply:* Yes, you can also setup which protocol and cipher suites are used. By default the device authenticate to Core with token but you can enable mutual auth
*Thread Reply:* Mutual auth is on by default @Mikey2000 Since a long time
*Thread Reply:* Thanks. Are there whitepapers regarding this?
*Thread Reply:* @Tohsheen Since when ? I enabled it on a test Core manually some month ago
*Thread Reply:* I was asking myself the same @Tohsheen .. MA is not default for us and we didn’t change anything!
*Thread Reply:* I guess he was telling TLS, and not Certificate Mutual Auth
*Thread Reply:* I only enable it when I go with Common Criteria mode
*Thread Reply:* Connection from /to device to Core is encrypted by default, that’s what was enabled a while ago
*Thread Reply:* in the old days, the provisioning port was by default 8080 but then it was moved to 443 with encryption,
*Thread Reply:* Think about it. MI Core and MI Sentry requires a paid TLS certificate to encrypt the communications from / to device to Core
*Thread Reply:* Right! Thanks for the great explanation! 👍🙌
*Thread Reply:* I had a sinking feeling we had decided to enable it by default. Thanks Raul for clarifying..back to my holiday
*Thread Reply:* there are many little options to tweak security in Core, but the default setup isnt bad.
*Thread Reply:* Very excited for this functionality.
*Thread Reply:* Keep in mind that AAD is always slower than MI Access
*Thread Reply:* Core delivers the complex configs to Sentry as soon as they contacts, so you only need to take care of the network config and the certificate
*Thread Reply:* Sentry is only a puppet managed from Core
*Thread Reply:* So from server perspective, you just need to take care of the system config, network and so
*Thread Reply:* The cert you use on Sentry portal doesn’t have to be trusted because it’s not exposed to internet so it’s up to you if you add a TLS cert there
*Thread Reply:* The rest is, network config, static hosts if you use them, and maybe ciphers selected (only for Core as Cloud also delivers the cipher config)
*Thread Reply:* I always say that if Sentry breaks for any reason (never happened to me before), and it takes more than 15 mins to fix it, burn it up and rebuild it. it’s very quick
*Thread Reply:* After contacting with Core, everything including the TLS cert exposed to internet will be delivered to Sentry automatically
*Thread Reply:* You say exporting config should be enough - what do you mean by that? The only things that you already mention are: Email settings, static hosts, user for the software updates.. and I thought I would need the TLS portal cert because some browsers will not let you login with the self signed.
*Thread Reply:* Sorry missed the point „export config“
*Thread Reply:* you can always log in by IP even if the cert is not trusted
*Thread Reply:* not out of the box as far as I know. you can build own reports regarding that or use third party software for that.
*Thread Reply:* I would be really interested in how you guys build your own reports or which third party you can recommend.
*Thread Reply:* count active devices via API, CSV export and import or reporting database
*Thread Reply:* Well but I can’t get out of Core how many licenses we have bought, right?
*Thread Reply:* no, you need to check your billing/delivery letter
*Thread Reply:* Yes, there is - IronWorks provides precisely this, along with suggested licence optimisation calculations and other reporting capabilities.
*Thread Reply:* But not available within MobileIron itself
*Thread Reply:* Do you know how IronWorks knows the exact amount of bought licenses?
*Thread Reply:* That information is keyed in (and updated with new purchase) by the finance department
*Thread Reply:* Just to clarify, typically the finance dept at the customer’s reseller.
Anyone using this Apple watch app? This is only for users to see and manage enrolled devices, like within Mobile@Work, right?
*Thread Reply:* I tried... but it’s not that great yet...
*Thread Reply:* late to this but to clarify ADFS isn't mandatory... other IDP's will do as well. We federated O365 with Okta and did DelIDP to MI Access after trying to do AzureAD conditional access with PTA. Users hated the constant pw prompts and the device trust for 3rd party mobile devices in Azure never go it to where we wanted it to be. SSSO is huge for our user base and we used MS Authenticator as the iOS SSO Broker app for all MS Office apps so its the only app that needs the VPN profile (there are some downsides to this but performance wise much better)
*Thread Reply:* As it’s for internal distribution, you have to sign it with your company Apple Enterprise Developer Identity, like any other in-house iOS app
*Thread Reply:* That’s what you need to deploy iOS in-house apps though UEM
*Thread Reply:* Ah ok thank you. But there is also a wrapping tool from MobileIron where I don‘t have to sign the app myself and this will be done by MI, right?
*Thread Reply:* Hi @Phil Hackett, we already have ticket for this issue. So far no answer from MI.
*Thread Reply:* Thanks @Ladislav Blazek I’m about to open a support ticket myself 😀
*Thread Reply:* MobileIron Service Degradation - Mobileiron Apple Productivity Apps - SET-20833 New incident: Investigating A number of MobileIron customers are experiencing a degradation to the service. Currently Mobileiron Productivity Apps are temporary unavailable from the Apple App Store.
MobileIron Site Reliability Engineering is investigating the issue and will provide an update or notice of resolution once we have collected additional information.
https://status.mobileiron.com/incidents/3df57g7z8fd8
*Thread Reply:* And it’s back in the App Store....
*Thread Reply:* That’s strange as iOS reads the required field on SIMcard and populates it so UEM can see it
*Thread Reply:* Android doesn’t do the same so depending on the carrier you will run into issues, but on iOS it should be perfect
*Thread Reply:* Yes this is weird. We don‘t have these properties on any iOS devices. And actually the operator that is shown within the overview of all devices is disabled in the operator settings page
*Thread Reply:* If the Nagios software is required to be installed as an agent to do the monitoring then this isn't possible as these are locked down hardened appliances.
*Thread Reply:* Ok and if this is not required?‘not sure if this is a default requirement for Nagios
*Thread Reply:* If it’s not required you should find if Nagios supports something like syslog or similar
*Thread Reply:* You can use snmp HOST MIB
*Thread Reply:* You can monitor Core and Sentry with Nagios but only to a certain level. You can see whatever is agentless provided by Nagios (https/https and some other ports). You can also use SNMP traps. But nagios has some agents which can be installed on the host for more detailed monitoring. You could set these up using the "misupport" cmd on the sentry/core. But you will get into troubles when you need MI support afaik. Or you need to get PS involved to have this certified.
*Thread Reply:* I made a plugin for Centreon, maybe it can used by Nagios https://github.com/nosari20/centreon-mobileiron-plugin
*Thread Reply:* Don’t expect that immediately or even later 😉 as MI doesn’t do everything that Avalanche does...
*Thread Reply:* There are probably better things PM can do than just EOL products
*Thread Reply:* Avalanche is great at Windows Mobile and Windows CE!
*Thread Reply:* That’s not an MI limit. It’s a limit that Google impose to deploy AE devices with a user account.
*Thread Reply:* You can enable Device Accounts, and there there’s no limit
*Thread Reply:* Ah I see.. good point! But this particular user has only 1 active device on Core. Are there older enrollments still stored on Google side somewhere?
*Thread Reply:* No idea but enrollment is linked to user, not to device.
*Thread Reply:* I can register 300 devices with the same user as long as the user have this setting enabled
*Thread Reply:* Not in Docs@work, this idea has been dropped due to lack of interest from customers. but Email+ supports that
*Thread Reply:* @NicolasR Thanks for your reply. Since we are using a DLP solution for email server, any unclassified documents will be blocked. Currently we only use Docs@work as document repository in the conatainer.Do you think i can push office 365 apps with MAM policies effectively and inform users to use office 365 apps to create and classify documents from mobile devices?
*Thread Reply:* With Filepass you can use Microsoft and Mobileiron apps
*Thread Reply:* After trying 3-4 times the enrollment works
*Thread Reply:* I am gathering all the relevant logs to find out more
*Thread Reply:* Do you have set system alerts on Core?
*Thread Reply:* If so, so you see alerts like unable to reach MobileIron Gateway?
*Thread Reply:* Maybe related to our firewall
*Thread Reply:* For ex, I receive this alert every thursday when my router is automatically rebooted, but once that router is up, I see all services OK
*Thread Reply:* If I receive it at any other time, then something bad is happening
*Thread Reply:* For me your case looks like networking issues
*Thread Reply:* Ok so I will also enable the system events on Core. Could be helpful
*Thread Reply:* The only thing that is strange we have the exact same issue on another Core with completely different network infrastructure.
*Thread Reply:* Do you have the right amount of resources for your metric?
*Thread Reply:* Performance issues can also reproduce the same issue
*Thread Reply:* How do you mean? Like enough RAM, CPUs on Core?
*Thread Reply:* Gotta check also. Not sure..
*Thread Reply:* I have 1 customer that was having a lot of issues and now that they have all healthy, they are running a Core with 100K devices without issues
*Thread Reply:* Can I see performance issues on MICS in Core? Like a full queue or something?
*Thread Reply:* Umm, I don’t know how, outside of Hypervisor alerts
*Thread Reply:* Ok thanks very good input 👍
*Thread Reply:* If you have mobileiron monitor, you should see performance issues there
*Thread Reply:* We don’t have platinum 😜
*Thread Reply:* maybe snmp performance mibs?
*Thread Reply:* or check logs for timeouts etc
*Thread Reply:* Should be in the core showtech right?
*Thread Reply:* Do you know in which log file?
*Thread Reply:* there are no special logfiles for that. Mi.log and webserver logs seem a good start for me.
*Thread Reply:* It works for me with this GPO and the config above on Access console
*Thread Reply:* I already uploaded the keytab file created with the command in the documentation
*Thread Reply:* It’’s also true that I use the same MS CA for DJ devices and for SCEP
*Thread Reply:* I did not use gpo, I have created the registry keys manually and everything is ok in the ADA logs
*Thread Reply:* I made this video a while ago for a customer, where you first see how unmanaged or not DJ W10 devices are blocked, and how a DJ W10 can access to SharePoint with WIA, and then how it can access to SalesForce and so with the Kerberos Trust Agent and then with WIA as well
*Thread Reply:* I don’t remember to configure anything else but the stuff above
*Thread Reply:* Thank you, I will review all the configurations
*Thread Reply:* Can you confirm that you have created the keytab using ktpass /out <a href="http://access.miada.com">access.miada.com</a>.keytab /princ <a href="mailto:HTTP/access.miada.com@MYCOMPANY.COM">HTTP/access.miada.com@MYCOMPANY.COM</a> /mapuser <a href="mailto:svc.miada@MYCOMPANY.COM">svc.miada@MYCOMPANY.COM</a> /crypto All /pass ** -ptype KRB5_NT_PRINCIPAL the -ptype KRB5_NT_PRINCIPAL suppress WARNING: pType and account type do not match. This might cause problems. . Thank in advance @Raul
*Thread Reply:* https://help.mobileiron.com/s/article-detail-page?Id=kA134000000Qy4QCAS
I used a command exactly like in the example
ktpass /out access.miada.com.keytab /princ HTTP/access.miada.com@MIADA.COM /mapuser svuser@MIADA.COM /crypto All /pass
*Thread Reply:* Same as I did to create the keytab for Sentry for ActiveSync, but this time for Access Desktop trust
*Thread Reply:* I tried both, the problem seems to not be there so
*Thread Reply:* We have had reports of this aswell, altough via core
*Thread Reply:* I see a MI post regarding an issue registering WPCOD + KME, that is Resolved in Mobile@Work 11.0.0.1 and MobileIron Go 74.1.0.2 (not yet released?) Maybe this is also related to the COPE -> WPCOD migration issue you are encountering.
*Thread Reply:* Yes indeed, also for KME enrollment you need to add a json data in the KME profile and use the option to let MDM decide enrollment type.
{ "workProfileEnabled": true, "quickStart": true }
*Thread Reply:* Hey Nicolas, Thanks - but that would mean that our Jabber infrastructure needs to be externally published, which it is not. Can you explain the Pulse Secure part.
*Thread Reply:* Well, Pulse Secure is a real full featured VPN including UDP tunneling 😉
*Thread Reply:* Cool.. but extra license right? We have platinum
*Thread Reply:* Currently the Pulse Secure part is not included in any bundle yet, but feel free to go and talk to your sales reprensetative, he will be happy to help I’m sure
*Thread Reply:* Enable Device Accounts setting on each account and you will be able to provision N devices in COSU mode against the same account, or create different local accounts
*Thread Reply:* If you also deploy kiosk mode, you can add a variable with an identifier to the Text Banner for later identification of devices when user call HD
*Thread Reply:* Great thanks - sounds good. Where is the setting for the device accounts?
Also, how do you recommend deploying the Android Enterprise configs for COSU, COPE and WP with device groups? This is a little different like with Core. Now we use only COSU so I just deployed it for test purposes on All Devices. But when I also want COPE and WP, I need to use custom groups. I had the problem that I created a custom manual device group, but I cannot assign the group to the device right away because its not enrolled. Whats best practice here?
*Thread Reply:* Create a user group where you add users. Then create the same group for devices, with a condition of the OS and User Group membership to belong to the USer GRoup you created on previous step
*Thread Reply:* If you just change from
*Thread Reply:* If the URL is the same, go ahead. No issues
*Thread Reply:* That’s better than 2 LDAP configs pointing to the same LDAP server
*Thread Reply:* I’ve done on Core and Cloud and no issues
*Thread Reply:* Right, but we already have two pointing at the same only with different ports. So i will remove to 389
*Thread Reply:* If you want to be sure that everything is working, force an LDAP sync after removing the old config
*Thread Reply:* The last keeps working, the first should never be on Work Profile
*Thread Reply:* On some new enrollments it won’t get installed.
*Thread Reply:* Well, Gallery is a system app so it’s very easy to enable it manually.
*Thread Reply:* I see it on my demo S10 on Android 11
*Thread Reply:* Yes at the moment we install it via AppCatalog. I will try it via Lockdown policy
*Thread Reply:* Update: Lockdown policy works fine - deployment via AppCatalog doesn’t work for most devices.
*Thread Reply:* I always add all the package IDs of Galleries as on other OEMs it’s different so better enable all of them
*Thread Reply:* If you don’t need to configure an app, like GAllery, it’s always better to enable them via Lockdown policy
*Thread Reply:* For Chrome, Samsung Email and so, then deploy the app as a corp app
*Thread Reply:* Right thanks. For some devices the installation of Chrome also fails. Other work profile apps on the same device work, only Chrome fails.
*Thread Reply:* It fails when Android WebView is not updated before to install Chrome.
*Thread Reply:* Once that it’s updated, Chrome installation happens
*Thread Reply:* How can we upgrade the WebView? Manually via Google Play?
*Thread Reply:* For DO mode devices it’s tricky but for COPE we recommend user to add a personal account to personal side as this should trigger update automatically, or simply wait as this will happen but will take time
*Thread Reply:* So for work profile it should be easy right?
Now that MobileIron has been acquired, I suppose it’s time to go back and dig up some photos/videos from the good ’ole days. Came across this one today, which was at a company event/dinner where the theme was a ❄️ snowball fight ❄️ 🙂
*Thread Reply:* M1 - The first user conference! 2011.
*Thread Reply:* I remember this. I attended as a Partner and will have to see if i can dig up any old photos from this event.
*Thread Reply:* yeah one of the best conferences that i attended
*Thread Reply:* I have the PLIST basic auth. but we use ADFS CBA with SAP. Could not find anything if SAP has KVP to support this
*Thread Reply:* This means you reported a bug or feature not implemented that will be on future future versions of Core
*Thread Reply:* You can reference this ID at a later date to ask for an update on it.
So a customer of mine just added a Whitelist string to the Honeywell OEM Config in Core and now it’s coming back with this. @NicolasR I know there was an issue with Core 10.8.0.0 similar to this. Has anyone encountered something similar here?
*Thread Reply:* I would recommend re-enrolling the devices with a different method other than DPC identifier so that the system apps like OEMConfig and the camera are left enabled
*Thread Reply:* I heard the same customer to complain around christmas even with the patch but the issue was gone by itself with no further action
*Thread Reply:* @NicolasR apparently it’s persisting. They’re going to launch a support ticket to dig deeper
*Thread Reply:* @NicolasR closure: they were able to resolve via direct fix in the DB
*Thread Reply:* The attribute is not set until the device is fully enrolled. Hence you can’t use it as a dynamic label to distribute configurations like the AE configuration. Doing so will lead the factory resets.
*Thread Reply:* Gotcha.. thats what I thought. Not sure why I need to enter that JSON data on KME for WPOCD. How can I use dynamic COBO and COPE labels at the same time? I can’t use manual labels because I don’t know when the user enrolls the device.
*Thread Reply:* You need to enter the JSON as KMEs enrollment model is DO. COPE was based on DO, but with Android 11 changed to PO (profile owner). Hence the JSON is needed to make sure a Work Profile is created instead of the device enrolling as a COBO device.
*Thread Reply:* What about a dynamic label that is the same as the COBO label instead using != Would that work? Never tried it, but it might work, unless you also have BYOD
*Thread Reply:* Yes I have also BYOD, but I covered that with != Work Managed like you mentioned. But since COBO and COPE are both Work Managed at first, I cannot use the !=. I would need a second filter option to bind COPE. But I don’t know which one. Is there something I can set in the KME JSON so I can identify the devices when they hit Core? This is a tricky one.
*Thread Reply:* I think this is the solution:
*Thread Reply:* Would be interesting which label filter property key1 is - @Raul I am sure you know this. Spain is you environment, right? 😜
*Thread Reply:* But it looks like that attributes are not supported for Work Managed with Work Profile - confused:
*Thread Reply:* WPCOD doesn’t support custom attributes, afaik
*Thread Reply:* Even when the current method to register WPCOD devices with KME, ZT and QR code will change in the near future for good, as per today you need a dedicated KME profile and so on for WPCOD
*Thread Reply:* So you can actually apply it to all devices that will be targeted as WPCOD
*Thread Reply:* Right, so: -have 2 different profiles in KME for old COPE and WPCOD -have 2 different labels on Core for old COPE and WPCOD. For the old COPE we can use custom attributes via KME JSON. And for WPCOD we have to use a filter option like AD groups or device serial numbers or something that might work. Because the registration status „work managed with work profile“ won’t work.
*Thread Reply:* did you added also the condition of Android enterprise capable = true to the dynamic label?
*Thread Reply:* In any case, that’s going to be a temporal WA as on future release of Core and Cloud, Android 11 device will be handled as DO in any case and after registering, it will receive the command from server to turn into WPCOD or remain as DO
*Thread Reply:* No I didn’t. I thought this was only relevant everything lower Android 6 (or 5.1)
*Thread Reply:* Nope, it’s required for timing thing when you send AE config to provision devices to DO, COPE, etc on a timely manner
*Thread Reply:* In any case, keep in mind that if on Android 11 we are no longer able to send attributes during provisioning, you should make your own approach with labels
*Thread Reply:* I guess that once that ZT portal is integrated as iFrame into UEM, this will be easier
*Thread Reply:* AS you can even provision SAmsung Devices from there
*Thread Reply:* Do you know when the iFrame integration with ZT is happening on Core?
*Thread Reply:* Still no idea as Google opened it at the end of dec
*Thread Reply:* Could OEM config help in this case?
*Thread Reply:* Hey, I think you have to invite him again
*Thread Reply:* How are you enrolling the devices? QR, KME, ZTE?
*Thread Reply:* you’ll need to pass the json string {“workProfileEnabled”:true} to the MobileIron app during enrolment.
*Thread Reply:* Screenshot from KME:
*Thread Reply:* You have been using the wrong APK url for the M@W client. The good one is the “nfc” url
*Thread Reply:* yeah so I'm using the NFC url I believe and work profile enabled is set to True
*Thread Reply:* KME not in place at the moment, expect no issues once I get that piece in place but relying on QR for now
*Thread Reply:* Yeah, built QR using MI Provision, then built another using straight JSON, both behave the same - fully managed work device, no profiles
*Thread Reply:* despire the WorkProfileEnabled:true and the config in MI dictating it
*Thread Reply:* have a call with MI later may be able to get to the bottom of it - We're on Core just updated to 11.0.0.1
*Thread Reply:* And the Android Enterprise config they get does have Work Profile enabled too? Labeling correct ? I have had no such issues so far with Core or Cloud so long as Work Profile Enabled was set to true in either KME or the QR
*Thread Reply:* Interesting - might blow it all away and start from scratch
*Thread Reply:* Some of their enrollment workflows predate me
*Thread Reply:* Oddly enough we got this working on Android 11 using Provisioner QR, but were unable to get it working using the raw JSON QR, though Android 10 liked the raw JSON QR just fine. 🙄
*Thread Reply:* thanks for your help @Mark Vonk
*Thread Reply:* By the way M@W 11.2 (April) will fix the Android 11 behavior for enrollment
*Thread Reply:* MI like WS1 is expected to turn down support for legacy DA this year, probably not to the degree of VMw but nevertheless. As well as this, since Nov last year the agents have required to target Android 10 in Play, rendering older DA APIs unusable.
If you're talking Samsung and integrated Knox APIs you'll likely be OK, but it's not a super experience.
*Thread Reply:* This is for management of Huawei devices.
*Thread Reply:* I thought VMware were maintaining support for DA for legacy builds like field forces using Zebra/Honeywell devices?
*Thread Reply:* Yeah but it's fully self-supported based on their docs. DA remains for existing customers, it's just not officially supported by default
*Thread Reply:* Google require any UEM on AER to completely remove DA for all Android versions in 2022, and on Android 10 in 2021
*Thread Reply:* Hi @Raul does that mean that the AER UEM's would no longer be able to offer an emrolment and management option for AOSP devices or am I missing something?
*Thread Reply:* There are other ways to manage those kind of devices.
*Thread Reply:* so if an org needed to manage chinese phones for offices in china with their UEM they could be out of luck or could another option be looked at. Asking for a friend 🙂
*Thread Reply:* I know, that’s why you can use a model similar to DO mode,
*Thread Reply:* made for China and for closed networks
*Thread Reply:* ah OK so the lieks of the closed networks offering from WS1 might still be on the table
*Thread Reply:* If the management is more similar to AE on DO mode than to DA, then yes
*Thread Reply:* At least MI is investing to keep supporting China devices while they keep making Google happy
*Thread Reply:* I guess that also other vendors will do the same
*Thread Reply:* Cool so Google's requirement to completely remove DA for all Android versions in 2022, and on Android 10 in 2021 would not force WS1 to remove offerings around closed networks to meet the AER UEM criteria then?
*Thread Reply:* I guess that yes. The idea is to deprecate the APIs
*Thread Reply:* But there are other APIs to be used
*Thread Reply:* more close to the AE model of DO mode
*Thread Reply:* Interesting to see how it plays out. I have a couple of use cases around this primarily for Chinese markets. My worry was OEM's that did not invest like Samsung in a strong set of OEM COnfig capabilities like KSP would be extremely limited to offer a supported management model
*Thread Reply:* > OK so the lieks of the closed networks offering from WS1 might still be on the table Yes, this is still AE, but without managed Google Play. Device APIs only. > My worry was OEM's that did not invest like Samsung in a strong set of OEM COnfig capabilities like KSP would be extremely limited to offer a supported management model An increasing number of OEMs are going to OEMConfig, but for closed network the apps will need to support pushing a config XML file.
*Thread Reply:* Thank you gents, you have given me food for thought
*Thread Reply:* I do have this scenario deployed and both W@W and D@W can open SharePoint sites through Kerberos.
If you have 1 url for all webapps, you should be able to open all creating a Sentry service and delegating the Sentry service account to connect to SharePoint server SPN
If you have 1 different URL for each web app (which is the most professional way to do), you have to create a different SPN for each one and grant delegation access to each one from Sentry Service Account.
*Thread Reply:* @Raul Thank you for your reply. We do have option 2.I dont have visibility to AD and our system admin has said that he is not able to add SPN of the web application for delegation under sentry service account as this are not machine accounts. How do we achieve that?
*Thread Reply:* https://www.noralku.net/2016/05/08/sharepoint-20132016-kerberos-authentication/
*Thread Reply:* Once that you have the SPN of each SharePoint URL properly configured, you can delegate them to Sentry service account.
*Thread Reply:* On iOS with W@W or Safari you will need iOS SSO applied, which is not KCD, but native kerberos, and works as well.
On D@W you just need to create the services, like on this example of OneDrive
*Thread Reply:* Dear Raul, Sorry to keep bothering you. I have now added SharePoint URL's under MobileIron service account delegation however docs@work is keep prompting for credential whenever application is launched. In debug logs, I can see 'not forwarding TGT for delegation because ..... not applicable(doing S4U2Proxy). Any thoughts on this error?
*Thread Reply:* I am supposed to see only FQDN of the web application under delegation tab
Core 11 - what is the background of the message „enable full windows and macos managment. Activate now“ Where can I find info about that?
*Thread Reply:* I see the same in Core 11.0.0.0.1 - everytime I dismiss it forever it comes back next login haha. I think it wants admins to walk through the basic enrollment configs for mac and windows but not 100%. I refuse to activate 😂
*Thread Reply:* that should go away provided you use the same browser it will remember the preference. You should be able to raise a support ticket to disable that banner
*Thread Reply:* This is for the MobileIron Bridge feature, now included with Secure UEM licences.
*Thread Reply:* That’s because we are still on phase 1 of support of WP-C
*Thread Reply:* During April it will be addressed on Core and Cloud, where device will be provisioned as DO mode (aka the flow you know for COPE and DO devices up to Android 10), will force user to register, and then UEM client will convert device into WP-C
*Thread Reply:* Then you will not need the parameter on json
*Thread Reply:* On Core it will require only M@W 11.2. No Core update is required.
On Cloud it will come within R77 and Go R77.
All will be released in April, but for sure beta of M@W 11.2 will be released before.
*Thread Reply:* If you mean single identity certificate uploaded to Core then yes, it is supported for Wifi, VPN etc.
*Thread Reply:* Yes, single identity cert. However, can the bundle be created/issued dynamically like Microsoft Intune does with their Cert Connector?
*Thread Reply:* No, this is manually uploaded file only. If you need automation, then SCEP is way to go. It doesn’t mean it needs to be direct (device -> CA). MI Core can act as middle man.
*Thread Reply:* Basically Core will handle the cert issuance and provisioning.
*Thread Reply:* Yeah, have a customer that stood up a new PKI and no NDES
*Thread Reply:* Ahhh… but MI Core need NDES for this.
*Thread Reply:* They’re moving to Intune and it utilizes their PKCS capabilities.
*Thread Reply:* I see… so technically you need to use DCOM protocol - not supported by MI, only SCEP.
*Thread Reply:* Yes sir! That’s what I was getting at
*Thread Reply:* everyone is migrating to Intune… /rant
*Thread Reply:* Migrating.. but the question is will they stay 😉
*Thread Reply:* Hey, some people need to taste a bad beer to appreciate the good ones
*Thread Reply:* Every customer that comes to me with the statement “I’ve tested Intune” always finish it with “And I don’t like it. That’s why you’re here” 😂
*Thread Reply:* Its a pretty complicated procedure still requiring two zebra apps to be distributed from Managed Play with Managed Configs
*Thread Reply:* If MI supports .ZIP based firmware updates then I would recommend that path since LifeGuard OTA still has a long way to go
*Thread Reply:* Not only do you need a AE binding and the devices to have access to the play store you also need the end customer to register a Zebra portal account and for the devices to all pass validation that they are under an active support contract before they are eligible to receive the updates
*Thread Reply:* Screenshots taken from SOTI’s Managed Play iFrame, but the concept is the same
*Thread Reply:* Thanks Matt. I will take a look at this! ✌️
*Thread Reply:* Yup, all our IronWorks customer ingests worked fine this morning - their EU instances, if that helps?
*Thread Reply:* @Jason thanks for the report back. I’ll give it another try today!
*Thread Reply:* well, there are 2 ways to do so.
mibrowser and mibrowsers:// URL patterns are declared by app developer and belongs to W@W so you can call it from any link.
You can develop your app adding a managed config that, without changing the URL links that the app shows, force the app to always open links within an specific browser (W@W).
*Thread Reply:* Ex, I can add a KVP to Email+ to always open any link on mail with W@W, even when those links are of type http:// or https://
*Thread Reply:* If your developer is good, it’s always better to add this feature within your own app
*Thread Reply:* Right I see. So in our case that might be a problem because the wrapped app is not our development, it is Cisco Jabber.
*Thread Reply:* Be careful with this as wrapping apps without developer permissions is a violation of the ToS
*Thread Reply:* We have signed a deal with Cisco
*Thread Reply:* Otherwise we would not have received the binaries
*Thread Reply:* This is a PIN if you use PIN based registration
*Thread Reply:* So just to clarify, no, not their passcode. It’s their PIN for PIN based registration
*Thread Reply:* Thanks @Jason @Florent N. my blood pressure is coming back down
*Thread Reply:* It’s impossible to gather Unlock PIN codes
*Thread Reply:* They are simply registration PINs as the rest of folks mentioned
*Thread Reply:* That CSV is cool to get when a PIN is about to expire, btw
*Thread Reply:* Thanks Peter. But isn’t it the case when you create a shared mailbox in O365 (which needs no license) you don’t get a password but the users which have been granted access can authenticate with their standard O365 password? We don’t have certificates with Core yet.
*Thread Reply:* Shared Mailboxes come in many shapes and sizes… Some have an underlying account some don’t. Some apps require “Full access” in order to access them (Outlook Mobile App being one) while others need just “Delegate” or “On behalf of”.. (Desktop Outlook)… AFAIK ActiveSync only allows you to connect to mailboxes with accounts behind. You can’t login as userA and get access to userB’s mailbox (over ActiveSync). We provision devices with certs for userA and userB in this case. Each configuring it’s own mailbox
Ivanti ad popped into my Facebook feed. All normal, I’d suppose. It’s the comment that made me laugh 😆
*Thread Reply:* This may deserve a Jim Philips emoji :legend: hahaha
*Thread Reply:* Not without an IDP, or without MI Access.
I’ve enabled ZSO on MI Core so I can leverage QR code or MFA.
*Thread Reply:* Great thanks. ZSO is part of the new Secure UEM Premium bundle right? If not, we have to federate our Core with ADFS and use ADFS MFA, right? Is there a guide for that?
*Thread Reply:* If you first add the new label and then remove the old label there is no impact at all (besides the fact that the Exhange config is removed from the excluded devices in the new label of course). No re=push of the mailbox.
*Thread Reply:* Excellent advice from Almar, I would caveat that you co label the Exchange config for as long as you can until all active devices have checked in (When doing this with customers I suggest 2 weeks) - this lets you manage the exceptions of devices that lose the mailbox for up to 4 hours by ensuring no impact on regularly active devices
*Thread Reply:* Worked like a charm! Thanks 🙏
*Thread Reply:* Have you tried changing the agentID of W@W to mimic Safari?
*Thread Reply:* Great input - no I didn’t. Is that KVP in the docu?
*Thread Reply:* Found it and tried this one:
Mozilla/5.0 (iPhone; CPU iPhone OS 1442 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1
Still the same.
*Thread Reply:* what is the system behind your webserver? SharePoint or which one?
*Thread Reply:* That I don’t know. I have to ask the product owner. It is not a Sharepoint. Is there a limitation or why do you ask that specifically?
*Thread Reply:* websites that works on Safari usually works as well on W@W as now both relies on WKWebView library
*Thread Reply:* IMAP ? ActiveSync; yes sure. But IMAP? It’s 2021 @Woody ! 😁
*Thread Reply:* @Mark Vonk You’d be surprised who is operating on IMAPS + OAuth these days. If you aren’t using the client specifically designed for your service (e.g Outlook/Gmail) there aren’t a whole lot of other options.
*Thread Reply:* No I do not think oath works for IMAP
*Thread Reply:* @Mark Vonk Check out GMail inside the iOS/iPadOS Mail client 😉
*Thread Reply:* I meant that MI Core does not seem to support oauth for IMAP. At least in the UI there is no option for it.
*Thread Reply:* Ahh yeah, that’s all handled client-side when you push the Google Account config to the device
*Thread Reply:* But agree, I’m not seeing much in terms of Email+ for iOS being able to usher-in an O365/GMail account using modern auth. It’s EAS or nothing
*Thread Reply:* Yes. CRL should not be published with SSL in general. But yes, it does impact it. You will need to re-push all client certs.
*Thread Reply:* I see.. An external audit flagged 8080 for CRL.
*Thread Reply:* Because you would than also need a CRL for the CRL.. literally speaking
*Thread Reply:* CRL, like certificates, are objects which are always signed, and never used without verifying that signature, so they can be served over plain HTTP. Using HTTPS to serve CRL is just wasted resources; it may even prevent CRL download from working since some implementations (e.g. Windows) refuse to follow HTTPS URL when validating certificates (be it for CRL, OCSP, or extra intermediate CA download), because that would mean SSL, then another certificate to validate, and possibly an endless loop.
*Thread Reply:* Thanks Mark! That explains it!
*Thread Reply:* It looks like with newer versions of Core the CRL is default 443
*Thread Reply:* I think that the sentence from the article is “you’d fall into an endless loop”
*Thread Reply:* This is the answer to that question from a MS MVP on the internet.
“Use HTTP since Microsoft clients no longer support HTTPS for downloading CRLs. Think about it, you are setting up a chicken and the Egg scenario. 1) I need to download the CRL 2) Oh the site is protected by SSL 3) Look the SSL certificate has a CDP extension. 4) Goto Step 1
Remember that a CRL is a public domain object and contains non-privacy information.”
*Thread Reply:* But why is Core using 443 for CRL as default with new versions then?
*Thread Reply:* I’d open a ticket with MI Support to ask that
*Thread Reply:* I have installed a new version in my lab and there is 443 default - this confuses me.
*Thread Reply:* Since Core 10.5 it should default to 8080
*Thread Reply:* Reachability of Local Certificate Authority CRL distribution points: The default port and protocol have changed for provisioning Local CA Certificate Revocation List distribution points (CDPs). The System Manager now configures CDPs to use port 8080 and protocol HTTP by default. Previously, the defaults were port 443 and HTTPS. Local CA CDPs that were configured to use HTTPS through port 443 will still be reachable. For more information, see “Port Settings” in the MobileIron Core System Manager Guide.
*Thread Reply:* So Core 10.5+ should install CA CRL over http by default, to avoid issues
*Thread Reply:* Twitter reveals they have released updated versions of the code with current certificates ~3 hours ago
*Thread Reply:* @Caryn Makes you wonder if something/someone was disgruntled as part of the acquisiton
By chance, anyone having issues enrolling Apple devices to MobileIron Cloud? Edit: It seems to be specific to the NA2 cluster
*Thread Reply:* Attempting via web-based and User Enrollment (kicked-off from the MI Go App) and seeing the same result
*Thread Reply:* Also tried using Cellular and WiFi. Same result. Really odd
*Thread Reply:* Received a few of these today in Core
*Thread Reply:* just a fluke on our side
*Thread Reply:* Interesting @Justin Butts. This one was weird, because it’s in the MI Cloud hosted environment
*Thread Reply:* Still continuing to be a hit-or-miss scenario
*Thread Reply:* @mahiroux IIRC (and it has been awhile).. Docs@Work enabled with AppConnect would connect with the Sentry which would use an identity certificate.. which could be configured in the Sentry to use Kerberos for the SharePoint site/URL.
*Thread Reply:* AppConnect is not supported within Android enterprise. The only viable option is hypergate right now.
*Thread Reply:* Looks like apptunnel is still supported in AE docs@work.I am still able to connect backend services from Docs@work.
*Thread Reply:* It might work, but officially it is not supported. See: https://help.mobileiron.com/s/article-detail-page?Id=kA13n000000PQSACA4
*Thread Reply:* AFAIK appconnect for Android is only maintained to service customers still on DA
*Thread Reply:* Hi Mikey, the block is being done by the Sentry server stopping the connection. Does not affect the underlying ActiveSync
*Thread Reply:* Thanks Steve. But since the mail client connects to Sentry, it should be blocked, right? I don’t understand the purpose of Sentry in this case if EAS will not be blocked
*Thread Reply:* The clients talk to the Sentry and then the Sentry talks to EAS. If the Sentry blocks the connection then the client does not get email as there is no route for it. Exchange itself knows nothing about this block
*Thread Reply:* Right thats is exactly what I mean. But the device still can sync emails via Sentry and the ActiveSync status on Core is not blocked even though the alert was triggered
*Thread Reply:* Maybe the device has been manually allowed. The block in that case won't be executed. Delete the activesync device on Core and once the device connects again,, it should be blocked now. Never manually allow ActiveSync device as it will break the automatic Block feature.
*Thread Reply:* In the lockdown policy you can define a blacklist of system apps to block.
*Thread Reply:* Do i need to blacklist all package ID of system apps?I am wondering why would Facebook and Gamespace considered as system app in OPPO?
*Thread Reply:* It varies by manufacturer, device and Android version which apps are deemed system apps. With Samsung on Android 11 Facebook is also a system app. I do not understand this either. I believe @Jason Bayton is passionate about this (ab)use too. Anyway, yes you need to add the package identifiers, like you did in the example 👌
*Thread Reply:* @Mark Vonk Thanks.What is the easiest way to get the package Id of this apps.We have a BYOD policy and users are coming up with as many brands are available in the market.
*Thread Reply:* I use an app like the following to find the app id: https://play.google.com/store/apps/details?id=com.csdroid.pkg Unfortunately with BYOD, you can't disable all system apps upon registration. This is AFAIK only available for Device Owner enrollments.
*Thread Reply:* Reach out to Oppo support to raise it with them as officially as you can. Send me screenshots showing the issue and I'll escalate with Google also. They've screwed up the vital app config either accidentally or purposefully
*Thread Reply:* Hola @Gianmarco Cerruti - Are you using Zero Touch? You can use the DPC Options to configure whether the system apps are enabled/disabled, etc https://help.mobileiron.com/s/article-detail-page?Id=kA134000000QxOmCAK
*Thread Reply:* You can disable it from Lockdown if Core or restriction config if Cloud
*Thread Reply:* If you want full control over the device and apps, it’s easier to just disable system apps and usher-in what’s needed. Then you know the bloatware is off the device and you’re in full control of what apps are installed/available for request to install.
*Thread Reply:* Thanks everyone! For these devices I disabled the app from the restrictions. In the future I will consider to disable them directly in the enrollment phase, but I think it is possible only for KME Samsung or Zero Touch AE, or I can from MobileIron regardless?
*Thread Reply:* Hi, using QR code for Device Owner mode there is a tickbox inside the MobileIron Provisioner app that lets you remove system apps, it is not Knox or Zero Touch dependent
*Thread Reply:* Perfect! Can I kindly ask in which menu I find the QRcode configuration for enrollment on MobileIron cloud console? thanks!
*Thread Reply:* Good one, @Steve Hayton! Yes, all that is initiated via the QR code that is generated (for whatever system you are enrolling into). In this case, the MI Provisioner App. Others dynamically generate the QR code inside the Admin/management UI, etc.
*Thread Reply:* thanks Woody, all done and confirmed working :)
*Thread Reply:* It doesn’t Citrix now have some fancy e-mail discovery config thing online
*Thread Reply:* https://www.citrix.com/blogs/2013/04/01/configuring-email-based-account-discovery-for-citrix-receiver/
*Thread Reply:* Thanks! I was hoping to pre populate our Citrix cloud tenant for the iOS app so users do t have to type it in
*Thread Reply:* Figured I would share in case this helps anyone. Figured this out with the help of Citrix
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>url</key> <string>companyurl.cloud.com</string> </dict> </plist>
*Thread Reply:* should have tried URL but I tried almost every other permutation of it lol
*Thread Reply:* Hi, I did our live (Exchange ActiveSync through a Sentry to Google) and Demo (Exchange ActiveSync through a Sentry to Office 365) yesterday with no Exchange profile modification/resend. I don't have a test with on prem any to test your specific use case but as far as I can tell this is not a global "Exchange Config" issue
*Thread Reply:* I received a notification from a certain local ACN about this …
*Thread Reply:* This is concerning - we have core updates due soon.
*Thread Reply:* Did you try ‘show portalacl’ in enable mode?
*Thread Reply:* It shows you the current acl rules.You can also change rules in config mode.
*Thread Reply:* not strictly mobileiron related but had something similar with WS1 before they put a fix in, that if you had an auto app update policy mixed in with any other policies it would cause issues and no apps will appear in the stores. The app update policy had to be seperate. Not sure if the same issues were seen across other MDM's but perhaps that could be a starting point.
*Thread Reply:* After updating Google play and the webview, do the other apps show up? What version of Google play store is installed?
*Thread Reply:* I have noticed some what similar behavior.However apps get installed and are available in MGP when ‘silent install apps for mandatory apps’ option is selected but its rationale was not understood.
*Thread Reply:* @Mark Vonk No other apps show up, Play services have yesterdays update, but issue existed prior as well
*Thread Reply:* @mahiroux yes, silent installs and the apps come down...usually....but cannot see them in the MGP store at all
*Thread Reply:* and don't want to silent install everything haha
*Thread Reply:* Did you by chance setup a Custom Store Layout (for example via the MobileIron iframe play store ui). If you did create a layout, I'm not quite sure if it can be undone so that all newly added apps are automatically added. Possibly a ticket to MI so that they can escalate to Google to clear the collections back to 'basic'
*Thread Reply:* Just to update this thread - Google has been involved for 3+ weeks now, and has so far been unable to fix this. I am having a really hard time with how this isn't a widespread issue
*Thread Reply:* Seems to be specific to MI Core - have not heard of this from other mdm vendors
*Thread Reply:* Is this is a relatively new Enterprise Google ID used for managed Google play?
*Thread Reply:* It's existed since at least late January
*Thread Reply:* worked as expected for a few months then...this
*Thread Reply:* did you update the config file that looks at the user agent? what does it look like?
*Thread Reply:* You mean config file of the existing relying party trust?
*Thread Reply:* no there is a config page update you need to make for adfs page so it routes only mobile traffic to this relying party.
*Thread Reply:* MI Access tries to obfuscate the change but the ADFSWebTheme change outlined in the instructions does this
*Thread Reply:* make sure that is only made to the relying part intended to and not the default web theme
*Thread Reply:* Certificate has been renewed, problem solved.
*Thread Reply:* Ivanti clearly still learning the ropes with their new acquisition
*Thread Reply:* reason #3,894 I can't wait to leave MI behind
*Thread Reply:* Customer is not using Managed Apple ID:s for now and I need to find a solution when user gets logged out - MS apps gets removed - next user signs in - MS apps gets reinstalled and no existing account is logged in in the MS apps
*Thread Reply:* Yeah / For my customer with GSuite.. it just came down to reminding users to log-out of their account when they finished using the device. Not perfect by any means, but they too did not not have managed IDs.
This is from the device logs on Core - does this mean the user removed the MDM profile?
*Thread Reply:* A previous KB said to try 10 times
*Thread Reply:* Need to make sure access to Apple servers I believe
*Thread Reply:* The CSR is created on the MobileIron Cloud infra (gateway) There was some maintenance yesterday (SRE-158305). It should be up and running fine now.
*Thread Reply:* Thanks it looks like internal issues, shutdown of all their internet services\firewall change freeze (sorry for delay in getting back on this, i appreciate the help) 🙂
*Thread Reply:* You mean:
{"workProfileEnabled":true,"quickstart":true} ?
*Thread Reply:* Yes I believe thats it! Thank you
*Thread Reply:* zScaler's IDP for SSO is Okta. Okta is DelIDP to MI Access
*Thread Reply:* I get the okta login page, it hits mi access and MI Access sees it as an untrusted device
*Thread Reply:* Interesting. So I wonder if something isn’t handing-off (user agent) from zScaler to Okta
*Thread Reply:* but you said it does redirect to Access from Okta
*Thread Reply:* Okay, so actually the chain there checks-out
*Thread Reply:* It’s just when the MacOS device gets dropped-off at Access that its failing to serve-up its trust credentials
*Thread Reply:* @Kiran Patel and before zScaler, Access was seeing the same MacOS device as trusted (Tunnel/VPN/Cert) and the SSO cycle would complete?
*Thread Reply:* yup exactlly, I don't think the macOS packet tunnel is able to load due to the zscaler steering agent
*Thread Reply:* its just the zscaler app itself I can't get to SSO
*Thread Reply:* What iOS version are the affected devices? There was a known check-in issue which was fixed in iOS 14.6.
Issue: iOS 14.x was found to stop processing MDM commands once a device receives a ManagedMediaList command.
Core check-ins include the ManagedMediaList command, even if you don’t use Managed books.
We found that affected devices were fixed by a reboot. This was confirmed by Apple support.
*Thread Reply:* Thanks for the info. The device has version 14.6
*Thread Reply:* I keep getting cert not found even though its on the device and I can chose it from identities
*Thread Reply:* Curious what the real world implications are here - we're juggling something similar and I can't imagine a live chat / video / conference call app is going to be a good experience if it's forced to VPN everything. Anxiously awaiting followup haha
*Thread Reply:* Totally with you on this. I am sure @Raul can help us out with this one! 😜
*Thread Reply:* IIRC you can selectively choose what is included in the tunnel. It should just be anything that matches your auth service URLs, etc. Everything else can be left alone.
*Thread Reply:* Gotcha. And for the case we just want to have the Access authentication use the VPN, how would the iOS VPN config has to look like - does anyone have an example or a link to a document how this should loom like?
*Thread Reply:* All traffic will routed through Access. Only authentication will be sent to Access. Due to how Tunnel works with the iOS per app VPN it will cause issues with the calling and video though. You have 2 options. 1. Don't apply a per app vpn to Team and instead distribute MS Authenticator and tunnel that app. 2. Configure the On Demand Tunnel config which is an always on VPN
*Thread Reply:* But If I don’t apply the VPN to the Teams app Access will detect Teams as an untrusted app.
*Thread Reply:* The authentication traffic only needs to go through Access. You can get that by setting up an on-demand vpn which connects automatically when the authentication URL (your adfs for example) is being called.
*Thread Reply:* Do you have an example config how this should look like?
*Thread Reply:* @Clark would you be able to confirm what Mark said here? Will that solve for this, without the degradation of voice and video?
*Thread Reply:* Within the on-demand tunnel config we need packet-tunnel instead of app-proxy (provider type) right? Can that coexist with another per-app vpn config for tunnel, because we also tunnel other apps via sentry.
*Thread Reply:* I am not really following Clarks option 1 with the MS authenticator app. The user opens the Teams app, which should go through the Tunnel in order for Access to allow the app. How would MS authenticator help here?
*Thread Reply:* Here is the steps for option 2: https://forums.ivanti.com/s/article/Securing-Skype-for-Business-and-Teams-apps-with-MobileIron-Access
*Thread Reply:* For option 1, if MS Authenticator is present on a device and you need to authenticate due to a expired authentication token, Teams will reach out to MS Authentication to authenticate on its behalf and then MS Authenticator will give the token to Teams. Since Authenticator does all the work, Teams does not need a VPN so there is no degradation of service for call and video. Also make sure that Access FQDN is listed in the Safari domains section of the VPN as MS Authenticator requires it.
*Thread Reply:* Thank you @Clark 👍🙌 And the Access FQDN would be like: access-eu1.mobileiron.com or do I need the tenant GUID in the FQDN?
*Thread Reply:* How would I apply the same concept to Android Enterprise devices since the VPN config is not used there? Add routes within the Tunnel app configuration? Enable Split Tunnel within the Access portal? As far as I know If I configure a Sentry within the Tunnel configuration and no routes, authentication will be send to Access and everything else to Sentry.
*Thread Reply:* Split Tunnel in Access is for iOS only. First question, do you have a need to route any traffic through a Sentry on Android or did you want to use Access only?
*Thread Reply:* Ah ok. Yes, we have a couple of internal web services that we use via Sentry. And know we want to add O365 services which we need to secure via Access.
*Thread Reply:* this is assuming that the internal network is using the 10 range. Update to suit
*Thread Reply:* Great thanks. And put the MS Teams app into the disallowedapplist, right? Just out of curiosity, you placed com.mobileiron etc in the disallowedapplist.
*Thread Reply:* I would leave Teams out of the disallowed list otherwise during authentication you will be marked as untrusted. Using the split tunnel rules you will only tunnel Teams during authentication to Access. Maybe also the IDP if on premise like ADFS as well.
*Thread Reply:* What is the question regarding com.mobileiron?
*Thread Reply:* in case you are interested this is the full list I generally start with as a disallowed list when on Core: com.mobileiron;com.mobileiron.client.android.pim;com.mobileiron.tunnel.android.release;com.android.vending
*Thread Reply:* For Cloud I use: com.mobileiron.anyware.android;com.mobileiron.client.android.pim;com.mobileiron.tunnel.android.release;com.android.vending
*Thread Reply:* All credit for these lists goes to @Raul
*Thread Reply:* That solved all my questions, thank you 🙏
*Thread Reply:* NDES - yes issue test cert works
*Thread Reply:* Only one user is affected which i weird
*Thread Reply:* Try the user with a different device (the easy check) otherwise its look at the cert logs on the NDES server!
*Thread Reply:* Good point, I‘ll try a new device. Why do you suspect an NDES issue, the cert has been issued and is visible on Core.
*Thread Reply:* Have seen it before with an AD related issue
*Thread Reply:* Ok different device same issue
*Thread Reply:* @Mikey2000 https://forums.ivanti.com/s/article/MobileIron-Cloud-Ports-Hosts-and-IP-Addresses
*Thread Reply:* For use with Apple or Android? I found there to several differences when going this direction, especially depending on what type of RADIUS system you’re interacting with.
*Thread Reply:* Our network guy told me that on the radius he has seen that the devive wants to do PEAP which makes no sense to me because I have not enabled it within the wifi config
*Thread Reply:* Ah, okay interesting @Mikey2000. Let me pull some of my previous configs and get back with you
*Thread Reply:* Great, appreciate it Woody, thank you.
*Thread Reply:* Hi, look under Windows Desktop Restrictions
*Thread Reply:* Hi.. yes I did. You can disable USB mass storage but I see no option in the GUI to whitelist company approved USB drives.
*Thread Reply:* Not as we normally know it, under User Settings you can set Admin Auth to password and PIN but it can only deliver PINs to your email account.
*Thread Reply:* Should be enough - thank you
*Thread Reply:* I can't figure out how to manage two different registrations on MobileIron. With Workspace One I can create sub OGs on which I have full choice of the type of Android Enterprise configuration I want to implement. On MobileIron with Spaces I don't find this possible and even groups don't allow me to do so, from what I've seen. Can anyone give me any hints? Thanks!
*Thread Reply:* Hi, I dont want to cause any confusion but you can use device groups (or even user groups) to differentiate between your config assignment. Is there a specific need you have for Spaces ?
*Thread Reply:* Yes I can use the distribution based on device groups, but my problem is to create the rules for this group. Normally the device is an element that 'appears' on the platform once it has been registered, so I don't know its attributes in advance. I would have liked to configure the distribution of the two profiles (WPoCOD and Fully Managed) based on the user, who is present on the platform or who I can also add manually to a group. So my problem is how do I create two groups of devices that in one case select one type of configuration and in one case another?
*Thread Reply:* what determines which they should be? If its the person using it then a user group tied back to your IDP seems ideal. If its device type and user you can bring an existing User Group into the ruleset for evaluating a device group. Apologies if this isnt what you are looking for.
*Thread Reply:* Many thanks! I came to a similar solution but unfortunately there must be something wrong with the FullyManaged profile configuration, because I can only configure the WPoCOD one. Thanks, at least now I know that the way is correct!
*Thread Reply:* You may need to reach out to Ivanti support about the FullyManaged - your method is sound so they should be able to give it a once over and assist?
*Thread Reply:* I wouldn't want to do something wrong with the Provisioner app and the QR code it generates, because WPoCOD works fine with Android 11 and configuration distribution with the device group created with the method you suggested. While for Android 9 an Android Enterprise profile registration error appears. However, when I try the Device Owner registration, neither Android 11 (device resets while searching for updates) nor Android 9 (same profile error) works.
*Thread Reply:* I'll try some further analysis and possibly write to Ivanti
*Thread Reply:* Sounds intriguing, the Android 11 Device owner reset indicates that it is not getting the AE configuration at all- (reset is the default response in that case)- try adding the serial number of the test device to a device group and add that explicitly to the Android Enterprise lockdown. if it still fails its definitely one for Ivanti
*Thread Reply:* Thanks...I'll try
*Thread Reply:* I cleaned up the environment and redid the tests from scratch and now everything works. Thanks for the support
*Thread Reply:* My pleasure, many times Ive done a revert and retest- sometimes things just don’t work even when they should. Best of luck with the rest of the project.
*Thread Reply:* No, it will say Intune as the MDM even though it’s the Core
*Thread Reply:* I found the check-in count within the app protection policy blade itself - but the count is 0 . Should this work for Core devices?
*Thread Reply:* Are you looking for something like SAML + MFA or just a straight MFA via RADIUIS, etc? Your best bet here is going to be SAML --> MFA. Core just doesn’t have support for anything more, unless you locked-down enrollment to trusted networks and enforced use of VPN to get enrolled, etc.
No tunnel specifically needed. Can have Sentry with just ActiveSync and OAuth pass through enabled Confirm OAuth in Sentry logs, look for Authorization: Bearer
*Thread Reply:* It seems so, I have issues connecting to the portal and enrolling devices….
*Thread Reply:* @Clark Does it need any specific roles assigned?
*Thread Reply:* Think it just needs the System Management but have not tested this. Normally the customer has used another call that had all roles assigned
*Thread Reply:* There is not much you really need to do. This would work:
*Thread Reply:* Great thank you 😅✌️ By any chance you have the same for Samsung Email?
*Thread Reply:* Nope. Normally I do not best to talk clients out of using that app as then you are tied into just Samsung devices. If you do not want to use Outlook for all devices then I would suggest looking at Gmail or Email+ 3 as both of them support modern auth and can be applied to all android devices, not just samsung
*Thread Reply:* Samsung e-mail does support modern auth and appconfig. So the config you need to apply is basically the same.
*Thread Reply:* Thinking I’ll probably need to go straight to the API
*Thread Reply:* Yup, unless you use a third-party tool, e.g. our IronWorks solution, you’re down to rolling your own with the APIs at the moment.
*Thread Reply:* Sorry, not ideal, I’d be the first to agree.
*Thread Reply:* Agree @Jason - You guys have a free trial? I might be able to sell them on it, since they’re sticking with MI Cloud for the long haul
*Thread Reply:* Yup, certainly. DM me for more info?
*Thread Reply:* Correct. If you retire a DEP enrolled device, it will only remove the MDM profile, managed apps, configs, policies etc.
*Thread Reply:* Thanks for confirming ✌️
For those who are not aware, Ivanti created a new community for customers & partners called “Ivanti Innovators”. On this platform Ivanti insiders (PM and other people) might add some great content to follow.
You can register here: https://innovators.ivanti.com/join/CSSTEMEA
Anyone on NA2 having issues deleting devices as of recently?
*Thread Reply:* It's mandatory because it Azure AD registers the device with the correct correlated Azure AD device identifier.
*Thread Reply:* I see. I am not sure if you are familiar with DUO? It has also the possibility to register the device in Azure. But it would not use the right Azure AD ID?
*Thread Reply:* MobileIron is not saying you have to use Authenticator. Microsoft is forcing this. Feel free to open a ticket asking MS for a feature request to use other applications for reporting back data to Azure. Will say that MS would likely be very resistant as they want to tie you into the MS stack as heavily as possible and allowing other apps goes in the opposite direction.
*Thread Reply:* I see. Thanks for the info. 🙌
*Thread Reply:* depending on your infrastructure you can achieve this after it leaves the device. For example, we use Exclaimer which applies the signature to all our emails regardless of the device. The device signature is just saved locally whereas the exclaimer applies it in the cloud after it is sent.
*Thread Reply:* Digging that solution @Ajay Patel. Centralize/standardize and be done. What layer does Exclaimer plug-in to?
*Thread Reply:* its done using a send connector, transport rule and receive connector so it can pass the email to their cloud signature solution and then back out to 365 for delivery
*Thread Reply:* but also an SPF record so that your emails are not classed as junk
*Thread Reply:* Ah, that makes sense @Ajay Patel. So it is more of a 3rd party handler instead of an integrated tool.
*Thread Reply:* yes i dont think Microsoft has anything out the box regarding signatures as they tend to be more client side (i.e. controlled from Outlook) whereas 3rd party products allow it to be controlled server side
*Thread Reply:* Update - under device details I can see MDM Lost Mode Enabled is false. I was able to send a lost mode request, but if the device is offline it will not send a new status back to Core, right?
*Thread Reply:* is the device supervised?
*Thread Reply:* when was last device check-in as it relates to you sending the lock command?
*Thread Reply:* Check-in was 2days ago. Sending the lost command was today
*Thread Reply:* Working as expected then? Can't get a command if it has no network or is powered down
*Thread Reply:* which it's likely one of those two things
*Thread Reply:* Thats what I thought. And thats why the request location is not working
*Thread Reply:* Ok thx.. which kind of beats the purpose
*Thread Reply:* that be how the internet works man
*Thread Reply:* But it should remain flagged as lost with Apple, right?
*Thread Reply:* I'm not sure what you mean by with Apple
*Thread Reply:* If the device goes online again, isn't it supposed to be flagged as lost on the Apple servers so no can use it anymore. At least that's what I was told how the lost mode works
*Thread Reply:* I'm not aware of that having anything to do with Apple servers but I could just be ignorant to that functionality. If that device ever re-gains network access, the Lost Mode command you sent should apply pretty quick
*Thread Reply:* it is my experience that it works when using a backup that does not contain certificates from MDM or device identifier from Azure. Otherwise it may fail
*Thread Reply:* If that backup originates from the same device, it will inherit supervision status (unsupervised) from that backup.
*Thread Reply:* Wouldn't that erase the supervision?
*Thread Reply:* Not sure about MI but in MaaS360 we would
*Thread Reply:* You mean you would erase the supervision or it works like that
*Thread Reply:* see https://www.ibm.com/support/pages/dep-ios-backup-and-restore-guide
*Thread Reply:* Nice reference @Eric Bos! Nowadays, there is also Quick Start to take into account -https://support.apple.com/en-us/HT210216 - the device-to-device data transfer piece doesn’t work for ABM enrolled devices, so a iCloud based transfer gets used. Fun addition in iOS 15 is that for new device setup, unlimited iCloud storage can be used for the transfer at no cost (for up to 21 days)
*Thread Reply:* Uhh what is this now? Do you have a link to any documentation?
*Thread Reply:* No it does not require it. It will show a banner:
*Thread Reply:* If Core is installed or updated to 11.4.0.0 release and mutual authentication has not been enabled, a red reminder banner will display in a ribbon just below the Admin portal masthead. To enable mutual authentication, go to Settings > System Settings > Security > Certificate Authentication > Client Mutual Certificate Authentication page. Once enabled, the banner does not appear again. For more information about mutual authentication, see Mutual authentication between devices and Core in the Managing Certificates and Configuring Certificate Authorities chapter of the Core Device Management Guide for your operating system.
*Thread Reply:* Thanks Mark. Exactly what I meant! 🙏
*Thread Reply:* Yet the first sentence is: Core now requires mutual authentication with managed devices for a more secure connection. 😄
*Thread Reply:* Required by putting up a red banner 😉 It does not enable it and you can choose to ignore it
*Thread Reply:* @Mikey2000 Starting with Core 11.4 Ivanti are providing a banner as a reminder to turn this functionality on, in future releases this will become mandatory to enable.
*Thread Reply:* OneDrive version 12.53.21 is out which has the fix for the app crash issue.
*Thread Reply:* @mahiroux Sorry, just getting back to this. Yesterday was pretty crazy
*Thread Reply:* Any insights into whether the EMMs going down the API route will be abandoning custom DPC?
*Thread Reply:* Nothing explicit but this is implied - AMAPI isn't giving up the DPC they ship with, and only one DO on-device. I expect they'll bring a bit more power to companion apps to accommodate missing features in AMAPI today
*Thread Reply:* Nothing says Mobile/Endpoint Management like MobileIr… er Ivanti
*Thread Reply:* I feel like it’s going to be an AirWatch/WS1 thing… where it’s formally called Workspace ONE UEM but everyone still affectionately refers to it as AW
*Thread Reply:* Because it rolls off the tongue so much easier
*Thread Reply:* It's a far cooler name. It'll be MobileIron whenever I talk about it forever more no matter how Ivanti try to erase it 😛
*Thread Reply:* @Yth This is coming in a future H1 2022 release.
*Thread Reply:* Sure! Android Kiosk gives you multi-user sign-in/out.
*Thread Reply:* Got it @Almar Diehl - I was checking the configs but they don’t really call it out in there. Just says Kiosk and launcher to present the apps you want present, etc
*Thread Reply:* yes, here is the guide for doing this: https://forums.ivanti.com/s/article/MobileIron-Cloud-Azure-Active-Directory-User-and-Group-Import-and-Authentication-7382
*Thread Reply:* Great thanks. I used this guide, but the sync is failing (AAD sync unsuccessful)
*Thread Reply:* Every time I have seen it not work was because there was a setting missed during the configuration. Recommend going through the setup with a fine tooth comb.
*Thread Reply:* I have gone over it with my colleagues - everthing was done exactly like described. Maybe a missing license on Azure? Are there any helpful logs?
*Thread Reply:* Never heard of anyone accusing Azure of having helpful logs 😆 In all honestly I am not sure what logs you would need to review on the Azure side. You are not trying to sign into Azure using an account that is federated or requires MFA are you? Confirm the account works by signing into portal.azure.com and is not getting prompted to update a password and ensure you are only using a onmicrosoft.com admin account
*Thread Reply:* Right, no my Azure Global admin that I used to accept the permissions in Cloud is non federated and non MFA and a onmicrosoft.com account.
*Thread Reply:* I guess this could be the issue: „Using Azure AD as the IDP requires a Microsoft Azure AD Premium subscription.“
*Thread Reply:* Found the issue - the documentation is missing one crucial point - granting admin consent in the MobileIron Azure Integration enterprise app!
I am kind of confused with this error message with registration of Android devices on Core. Device has a label with an Android Enterprise work profile config prior to registration , but we still receive this error with some devices. Not all of them. Has there been a change with new Core versions and AE enrollment? Sure this is DA mode, but we have attached an AE config anyway like we always did.
*Thread Reply:* We had the same after upgrading Core to 11.3. Fixed it by applying the label Alle Android Devices to the AE config. All labels we had applied before had a more complex filter that seemed to apply just after enrollment.
*Thread Reply:* This is strange. Gotta try it - thanks Almar
*Thread Reply:* But how would you solve that with different enrollments like COBO and COPE?
*Thread Reply:* Hi @Florent N. there are currently no plans to support Nutanix AHV for Core/Sentry. Currently support platforms are VMware and Hyper-V. IF you are running Nutanix as an all-in-one hyper converged platform with VMware ontop then no issues with that as its still VMware
*Thread Reply:* iOS can be a bit tricky. You need the app installed first. And running
*Thread Reply:* You mean start QS on the device before initiating remote support on Core?
*Thread Reply:* Yes. Then try it. Oddly ios is not friendly to qs
*Thread Reply:* And the user must also activate screen sharing for teamviewer (Notification Center) right?
*Thread Reply:* Yes, it's all about permissions
*Thread Reply:* You'll need to raise this with mobileiron. Capture a bug report after replicating it and they can escalate to the OEM.
*Thread Reply:* Hi , you can set allowed list to have the “per app” experience if that is what you are referring to? or is it related to restricted system settings as per here: https://support.google.com/work/android/answer/9213914?hl=en
*Thread Reply:* The question was rather: how can MobileIron Tunnel on Android Enterprise devices be triggered? On iOS you can trigger Tunnel when opening an app. As far as I know this is not possible with Android.
*Thread Reply:* For instance: opening Chrome will not trigger MobileIron Tunnel even Chrome is in the allowed list within Tunnel
*Thread Reply:* it will be an always running VPN. We are limited to the limitation of the OS.
*Thread Reply:* ^ but you can still define per-app VPN split tunnelling and the usage of always on VPN isn't a colossal battery drain if it's not routing traffic
*Thread Reply:* @Mikey2000 Enable Trace logging and look at the MIFS file
*Thread Reply:* @mahiroux Did you register your domain with MobileIron to find your core? As alternative you could add the URL manually then authenticate on Core to enroll. Make sure that the Android Enterprise Workprofile Config gets applied on the device.
*Thread Reply:* Opened a case with Ivanti and this issue is currently noticed in following models as well.Ivanti has opened a vendor ticket with Samsung.
SM- A105F
• SM-A110F • SM-A520F • SM-A720F
*Thread Reply:* This issue has been identified as a bug and the fix is expected in m@w client 11.6
*Thread Reply:* Did you try downloading the previous version of M@W using this URL?
https://support.mobileiron.com/android/mobileiron-MIClient-11.4.0.1.apk
*Thread Reply:* Tried 11.4 and 11.3 but the result was same.Later Ivanti confirmed that issue affects previous versions as well.
*Thread Reply:* Issue is fixed in M@W 11.5.1 which in currently in Beta.
*Thread Reply:* But there is no support for iOS 15
MobileIron Access only for one Relying Party Trust - does anyone know how this has to be done on the ADFS? I am not an expert on ADFS, but I am thinking: Set-AdfsRelyingPartyWebTheme -TargetRelyingPartyName "Office 365" -SourceWebThemeName "MobileIron Access"
*Thread Reply:* If you are pushing EOL traffic through the sentry then short answer is you can’t. Device Authn to Sentry will be cert based and then from Sentry to EOL will be just a passthru
For passwordless you will need to setup CBA for EOL and have traffic direct to EOL rather than the sentry
*Thread Reply:* iOS native email supports CBA, you no longer have the Sentry server providing compliance checking, instead use Partner Device Compliance to get your MI Compliance status into Endpoint Manager to get the required control should a device fall out of compliance
*Thread Reply:* Thanks Steve and Martin for the valuable comments.Will this set up work if O365 have MFA enabled?
*Thread Reply:* yes you have to install authenticator on the phone
*Thread Reply:* Mandatory for partner compliance (ie authenticator on that device not another phone you happen to have)
*Thread Reply:* Thank you @Steve Hayton, CBA+Oauth with partner compliance works android AE Email+?
*Thread Reply:* We use ADFS.Can we still use CBA+Auth or do we require access for email sync to work?
*Thread Reply:* @mahiroux this KB article should assist with intune MAM policies through MI https://forums.ivanti.com/s/article/MobileIron-Core-Office-365-Mobile-App-Protection-Graph-API-7265
*Thread Reply:* Why do we need graph API,cant we push the MAM policy directly from intune?
*Thread Reply:* Why manage them from 2 consoles when you can create and deploy them from MI Core/Cloud to O365 apps and also view the status/reporting for devices from the one console?
*Thread Reply:* Is there any limitations if we manage Microsoft apps using graph API over directly using Intune MAM policies.Do we have all the intune MaM policies available with graph API? Sorry for being naive as i don't have much knowledge intune and how it works.
*Thread Reply:* You get all the Intune MAM policies available to you when you setup MS O365 Graph API
*Thread Reply:* You do it with Graph API
Think this is what you are looking for https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outloo[…]ook-for-ios-and-android-configuration-with-microsoft-intune
*Thread Reply:* You a right. Looks like we have the same issue with Core MICS. We are able to login with the local admin account within the Admin Portal, but no the System Manager. This is weird.
*Thread Reply:* the passwords are not synced past the first setup, Admin and System thereafter become different accounts so the password changes are independent
*Thread Reply:* do you have the enable password for Core?
*Thread Reply:* We have it.. but its not working. Nobody changed it.
*Thread Reply:* We used the account which was setup during installation
*Thread Reply:* raise a support case on the Core, you need to get back into it. had you applied all the log4j patches?
*Thread Reply:* I guess not on all systems 😀
*Thread Reply:* ok, when you get back into it (Core) do a chassis swap ASAP
*Thread Reply:* get yourself back into the Core then tag me here and we can discuss in direct chat
*Thread Reply:* I always thought it was 24h after app update is available in public app store
*Thread Reply:* nothing from within MI. You may want to check with MS to see if they have any alerting
*Thread Reply:* why in the world was this removed?
If only they had left the product name alone… #MICore
*Thread Reply:* Does Teamview allow to separate connections to the same device? If Teamviewer allows it, I would see no issues from the Core side
*Thread Reply:* Good question. Not sure but I believe I have seen that. Gotta test this
*Thread Reply:* Update: You can only connect once to a device. A second session is not allowed - TeamViewer message: already connected..
*Thread Reply:* @Peuge did MI build an app in AAD that is handling user lifecycle (vs just providing a feed of users/groups)?
*Thread Reply:* So we assigned the app to all users and mI cloud is absolutely not pulling in all users
*Thread Reply:* seeing 82 I think in AAD, 78 in MI Cloud, users populated in the Users tab look okay, but then there is another discrepancy with MI Cloud's All Users group which only contains 57 users and is requiring me to one-by-one add more users so they can actually enroll and not get hit with invalid creds
*Thread Reply:* Are any of the users in nested groups as MS does not support that. Also, check as I believe there will be an error log on Azure it refuses to sync users. Could give you a clue as to why it is not syncing everyone.
*Thread Reply:* oooh wait so even if the ent app is assigned globally to all users, if a particular user resides in a nested group, they won't get auto-imported?
*Thread Reply:* That could be what I'm seeing
*Thread Reply:* is the re-brand causing the outage I am having?
*Thread Reply:* No, that rebranding has been in place for a few weeks now depending on the location of your tenant. Are you on na2 by chance? I am seeing some odd issues in my lab on na2. I would suggest opening a support case on any outage you are seeing
*Thread Reply:* Yea it was tongue in cheek haha. But yes I am experiencing issues on na2
*Thread Reply:* @Clark Support says its an na2 outage. As of 5 minutes ago no eta and no idea what caused it
*Thread Reply:* Per the status page a fix has been put in place
*Thread Reply:* Indeed, this is the notification you get when the VPP licenses are set to user based.
*Thread Reply:* weird - could have sworn they were all device based - thanks!
*Thread Reply:* It is possible.You may refer the Email+ Documentation.
*Thread Reply:* That’s a great question. Technically you could deploy it as a managed app. If perhaps the licensing/activation can be pushed as part of the payload, I don’t see why not. No idea what MI/Ivanti would say though.
*Thread Reply:* There is no licensing model to cover this type of setup. Docs@Work is designed as part of AppConnect and uses Mobile@Work for the authorisation
*Thread Reply:* @Ala Almaet darn. You'd think they’d explore that. I know EBF and Hypergate sell file clients that are UEM agnostic.
*Thread Reply:* Out of curiosity, what's the use case for Docs@Work in an Intune environment?
*Thread Reply:* Our use case is to access On premise CIFS network share.
*Thread Reply:* I am in touch with EBF sales team and probably arrange a POC soon.
Anyone here using Hypergate for the same scenario?
*Thread Reply:* @mahiroux While I don’t personally know anyone using Hypergate in the field, I’ve set it up a few times. It’s pretty much straight to the point
*Thread Reply:* My guess would be a hardware requirement that the device doesnt meet. MC93s can be optionally equipped with a camera so my guess would be the app requires camera access and the MC93s that aren’t installing don’t have cameras
*Thread Reply:* You are right - the device where it worked has a camera, so very good hint. MC93C is the one where it works - C for Camera? So ask the developer about the hardware requirements? Is there a log where I might find details about that? I have pulled ADB logs and bug report but nothing useful.
*Thread Reply:* I think the developer would have to resolve this somehow yeah. I want to say its Google Play that is detecting that the camera is requested somewhere in the app manifest and refusing to install it on devices without cameras in order to avoid frustrating/ confusing the end user. Its a consumer grade protection feature that can get in the way in situations like this. I think you may be able to install the APK directly on the devices without involving Google Play if the developer can provide you with a copy. That might be the easiest route unless the app truly needs the camera for a given workflow.
*Thread Reply:* Great, thanks Matt. 🙏 Maybe there is a way to find hints about the hardware requirements in the app permissions within the iFrame?
*Thread Reply:* Just in case if the developer is not willing to invest time 😃
*Thread Reply:* You could potentially download the APK from an APK mirror and then unzip it to extract the manifest to inspect it yourself
*Thread Reply:* but if it is a private app published just to your org id it likely won’t be in an apk mirror
*Thread Reply:* I’ve used this before: https://www.sisik.eu/apk-tool
*Thread Reply:* I have checked the manifest:
<uses-feature android:name=android.hardware.nfc android:required=false
and
<uses-permission android:name=android.permission.CAMERA
so if the device has no camera, will the permission tag prohibit the installation? Or rather the android.hardware.nfc if the device has no NFC? Even though its not required.
Our developer will provide a new APK on Monday.
*Thread Reply:* I think without the camera it will potentially install if sideloaded, but the app itself may become unstable or crash depending on if the developer has designed it to gracefully handle a lack of camera.
*Thread Reply:* Depending on what the app does it may have a workflow that requires a camera at some point and without that the app may crash or create a dead end for the end user.
*Thread Reply:* You hit the nail right on its head - developer changed the hardware requirements. Now it works. Thanks Matt, learned something again 👍
Any idea why this happens on Core locating a device? I am thinking either a browser issue or a FW block - if I try this from an external workstation it works.
*Thread Reply:* Core is trying to load resources from Mapquest. I'd put money on a proxy config or firewall rule blocking it.
Wouldn’t you know, mid-way through maintenance and NA2 goes south. 😑 https://status.ivanticloud.com/incidents/bp4rj7z9b04b
NA2 is acting up again. https://status.ivanticloud.com/incidents/kp6lpt63mcnd
*Thread Reply:* Without switching to AE all other options would require users to set up the email themselves. Cant push an Exchange config to samsung email app that uses modern auth when doing DA
*Thread Reply:* Hi Clark, That's confirming our same conclusion. Thanks for the reply
*Thread Reply:* I think you can enable the modern auth with samsung native email app. Samsung native email app does support moden auth now. You need to make or add some custom config for this. Check on samsung website but not sure about DA mode.
*Thread Reply:* @Mikey2000 we have this working. What does your VPN profile look like under Safari domains?
*Thread Reply:* Maybe creating a msi file which install the ppkg using PowerShell https://learn.microsoft.com/en-us/powershell/module/provisioning/install-provisioningpackage?view=windowsserver2022-ps
*Thread Reply:* Device remained fully managed with full access until I forced a manual check in within MobileIron App > Settings > Force Check in....the check in button from the MI App splash page does absolutely nothing
*Thread Reply:* I can count on zero hands how many people are going to perform that action post retire
*Thread Reply:* I have seen it take some time and a manual check-in does force it. Check the setting in the sync policy to confirm the device does check-in regularly
*Thread Reply:* A lot of people are jumping ship to Intune from my perspective
*Thread Reply:* Intune is very competitively priced and wrapped up into an o365 subscription for ease of billing. I think it’s also part of the whole “no one ever got fired for bringing in IBM/Microsoft” mentality at the CIO level.
*Thread Reply:* In my experience with Intune however it is incredibly poor at handling the use case I care about (fully managed Android devices) and customers are not realizing that until its too late.
*Thread Reply:* @Matt Dermody I completely agree with you. This situation is so cringey
*Thread Reply:* Also have to remember… every decade or so senior level management rotates out. New blood seeking “new” ways to show how they’re helping the company. The MS value proposition/price is very attractive to people in those positions. Then in 10 years, it’ll be time for the waves to go back out b/c Intune isn’t meeting their needs.
*Thread Reply:* On March 31, 2024, Ivanti Endpoint Manager (EPM) will end support for managing iOS and Android devices. EPM will continue supporting Windows, macOS and Linux.
This notification applies to customers who purchased EPM prior to January 1, 2022. Customers who purchased EPM on or after January 1, 2022 are not entitled to iOS and Android management.
*Thread Reply:* customers will need to use Ivanti EPMM instead (new name for Core) or go Cloud based with Ivanti Neuron for MDM (rebranded name for MI Cloud)
*Thread Reply:* From memory there is a 30 day grace period, so if the new UEM replaces the VPP license key within the grace period, you should be good.
*Thread Reply:* Cert based auth or Access are your two options I can think of.
*Thread Reply:* Is there a good guide how to configure CBA with MobileIron and Exchange Online?
*Thread Reply:* you would need to provide more details on the environment. What is the IDP?
*Thread Reply:* We have PHS, so no federated domain with ADFS
*Thread Reply:* if you are using Azure, which I think you are saying (correct me if I am mistaken), then see this article: https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-certificate-based-authentication
*Thread Reply:* we have successfuly tested in our lab CBA with exchange online in combination with conditional access rules - if no certificate is presented the users get prompted for 2FA. We have also been using CBA for years with Exchange online and it works well. Very easy to configure via powershell. PM me if you want further info
*Thread Reply:* Exactly! But not on every device.
*Thread Reply:* But we have not found a pattern whats wrong.
*Thread Reply:* was it enabled at one point to be removed and someone updated it so it was no longer set to be removed?
*Thread Reply:* Exactly! We have updated it a couple of weeks ago. Originally it was always set to remove after retire.
*Thread Reply:* I was told my support a while back that this setting will only get updated on an app already installed after there has been an update pushed to the app by the vendor. FRom Core I would recommend pushing updates to those that are available for to help with not removing the app. Last update was on Dec 14, 2022 so there is a good chance this will catch a lot of people and help with not removing the app
*Thread Reply:* Holy sh**, that I some great input. Thanks a lot Clark. That could explain it. You mean push updates for the Authenticator app? How can I push updates l, do you mean the automatic app update checkbox within the app settings?
*Thread Reply:* Really shocking how most Core customers are not aware of this feature but check the box next to Authenticator > Actions > Installation Request and then configure the pop up like the below and click Apply
*Thread Reply:* So @Clark if you change the flag and you push an update… it effectively updates the state of the flag on the device without re-installing the app?
*Thread Reply:* Does that carry-over into MI Cloud as well?
*Thread Reply:* as devices check in they will receive the prompt to update unless they are DEP and it should then be silent
*Thread Reply:* @Woody app is already managed, this is just telling the app to update to the latest version and when doing so changes you did for the app in Core like not uninstalling should then take affect
*Thread Reply:* Right, forgot about this one. :facepalm::skintone_2: Thanks
*Thread Reply:* Okay. Just to be clear though, if an app is set not to uninstall on unenrollment and you change that preference… is there a way to push the updated setting to the already-installed app?
*Thread Reply:* as far as I am aware of no, unless there is an update to the app version or the user uninstalls and reinstalls
*Thread Reply:* @Clark oh, that’s nice. So if the vendor releases an updated version of the app (say via App Store), the updated managed payload (with preference to uninstall) would then be applied? Could be useful down the road.
*Thread Reply:* Right. But normally you have one AE enrollment config for WPoCOD and a separate one for COBO. Which filter property would you use? Because both are DO / Work Managed.
*Thread Reply:* What’s the criteria you are looking for to distinct when user provision a device in DO mode and when in COPE/WP-C?
*Thread Reply:* I don’t know the exact wording, but we used the Registration Status (like work managed) within the filter label. Its Work Managed and Work Managed with Profile or something like that. Finally we ended up using LDAP groups
*Thread Reply:* Yes, but I’m asking what would be the expected behavior.
What is the expected behavior .
Are you looking for defining from ZT/KME the expected AE deployment instead of from UEM side?
*Thread Reply:* Yes we enroll via KME. So the profiles within KME should match the correct AE config on Core
*Thread Reply:* Because M@W supports passing keys so you should be able to apply a custom attribute to devices provisioned with a given ZT or KME or QR code
*Thread Reply:* That is exactly what I am looking for
*Thread Reply:* If you check MI Provisioner you will see fields at the bottom when you select M@W
https://status.ivanticloud.com/incidents/dslxsm6rfk6j
*Thread Reply:* Did you try with custom search?
*Thread Reply:* Is that just doing an advanced search under Devices?
*Thread Reply:* I wanted to mean advanced sorry
*Thread Reply:* IMHO… while MI Cloud is easy to use and is for the most part stable/available… I don’t think I’ve seen any improvement/innovation on product in quite some time.
*Thread Reply:* Agreed @Woody. I've only just started managing it a little under a year ago and it feels a few steps behind other MDMs.
*Thread Reply:* @Rob B I consider it to be a happy medium between some of the more basic ones like Meraki and then the super in-depth offerings like WS1. Just really comes down to your needs and budget.
*Thread Reply:* @Rob B I have a few scripts you can use. It will export to csv and it written in powershell. Let me know which fields you need I got you.
*Thread Reply:* Figured this out. I had “server URL” in my ZTE config and that was stopping MI Go from allowing username entry/lookup (and subsequent modern auth for said user).
*Thread Reply:* Hi Woody, can you share the example DPC json that you are using? thanks Gary
*Thread Reply:* @Gary — This was for a customer, so let me see if I can scrub it and send
*Thread Reply:* Profile owners don't get access to device identifiers, so not really
*Thread Reply:* https://support.mobileiron.com/support/CDL.html is still working fine
*Thread Reply:* Oh perfect, wrong link saved I guess :)
*Thread Reply:* Well you can add multiple, as long as each Core only services one platform.
*Thread Reply:* I see.. like Core 1 only iOS and Core 2 only Android. This is not the case. We have 3 Core instances in our company with iOS and Android on every Core.
Can anyone explain what is causing this? We have a lot if devices where W@W brings up the message „not authorised“. User is compliant. AppConnect Policy is applied. W@W feature is globally enabled.
*Thread Reply:* The package name is still the same though, com.mobileiron.anyware.android, from what I see. In the KME configuration, how did you configure the MDM client part?
*Thread Reply:* It appears the package is still available at https://support.mobileiron.com/cloud-android/current/MobileIron-Go-latest.apk
*Thread Reply:* Seems like the app icon/branding is updated in the Play store, but after its installed its still called MobileIron Go with the old blue M icon.
On iOS it still looks like the old name and icon.
Seems kind of odd
*Thread Reply:* Can confirm, it was a coincidence that the Go app was rebranded at the same time my customer had an issue. Turns out theirs was stemming more from lack of licensing in the Samsung Intelligence app. She mentioned she was seeing the new Ivanti Go and that’s what threw me off.
Hey gang — Can anyone remind me, if no check-box is selected on the Core ACLS… does that mean that said service is not exposed/accessible (or is otherwise wide-open for access)?
*Thread Reply:* It is wide open; services are exposed to all. You need to check the box and limit it to the IPs you need to expose it to.
Nice to see MI Cloud gaining support for ChromeOS.
*Thread Reply:* Did you ever manage to get this fixed?
*Thread Reply:* @Mark Vonk admittedly it stopped occurring for me. Are you still seeing it?
*Thread Reply:* As far as I know there is no limit, unless you are killing the Core with API requests 😉 in that case you are limited to the resources applied to the Core.
*Thread Reply:* Thank you Mark, that’s the direction that the team was going to, making sure enough CPU will handle a rush of API requests !
*Thread Reply:* You should do it from the VM console. In order not to get stuck in a loop I would add the VM network first. Then update the IP address and after that change the routes (gateway)
*Thread Reply:* Thanks worked like a charm
*Thread Reply:* Could be this issue: https://forums.ivanti.com/s/article/EPMM-WiFi-configuration-fails-to-install-on-Android-devices
*Thread Reply:* Are the devices A13? https://mobilxperts.slack.com/archives/C1V8JC31T/p1687943586782749?thread_ts=1687938080.448419&cid=C1V8JC31T
}
*Thread Reply:* Interesting - thanks guys.
*Thread Reply:* In the first sentence of the article they mention that 11.9.0.1 and below is affected. There is also 11.9.1.0. So only 11.10.0.1 includes the fix and 11.9.1.0 is also affected - can anyone confirm this?
*Thread Reply:* From reading the article, 11.9.1.0 is also affected.
If you’re running an affected version, you will need to upgrade to 11.10.0.1 OR manually install the RPM package.
We’ll be installing the RPM, as we never run the latest release.
*Thread Reply:* Hey Peuge, how are you my friend? Hope all is well with you. I am not seeing any issues on NA1. What cluster are you having issues with, NA2? I have not heard of any problems from the customer base, which is mostly on NA2.
*Thread Reply:* We just finished last weeks patching 🙂
*Thread Reply:* (context: https://techcrunch.com/2023/07/25/ivanti-epmm-zero-day-norway-government-breach/)
*Thread Reply:* We just got notified about another one a few minutes ago.
*Thread Reply:* Yes, wonderful (not). https://forums.ivanti.com/s/article/KB-Arbitrary-File-Write-CVE-2023-35081?language=en_US
*Thread Reply:* If I read correctly, this is the privilege escalation step used after the initial exploit patched earlier this week, same customers affected.
*Thread Reply:* Yes, but the k-item also says "CVE-2023-35078 reduces the complexity of executing CVE-2023-35081". So even after patching 35078 customers are still vulnerable voor 35081.
*Thread Reply:* my favorite part is we haven't been able to update our Core as we are getting a "download failed" error when updating.
We used the RPM fix in the interim. But with this new CVE it looks like we actually need the Core update to work correctly. Hopefully this 2nd call with Ivanti support can get it figured out
*Thread Reply:* Those trying to keep up with all the Ivanti exploits CVE-2023-3582 impacts all versions of EPMM/Core. This article has details on the patch https://forums.ivanti.com/s/article/KB-Remote-Unauthenticated-API-Access-Vulnerability-CVE-2023-35082?language=en_US
*Thread Reply:* You can block USB to any machine that does not have the Supervision certificates on it.
*Thread Reply:* So I have to create a certificate with the Apple Configurator 2, use that cert within the DEP profile and every computer that has that cert installed is a trusted computer and can sync with the devices. Is that limited to macOS or can Windows also be used?
*Thread Reply:* The supervision certificate may already have been created but if not then yes create one with AC2 (macOS only) then use that on the machines you want to sync with. set the device to only allow sync with supervised devices.
*Thread Reply:* Ok, so create the cert only on macOS because of the AC2, but we can install the cert also on a Windows machine to be a trusted device? Or is this also just macOS?
*Thread Reply:* I am not sure, I know how the process works but I don’t use Windows machines so I have never tried. I would not hold my breath for it to work. Sorry I am not more help.
*Thread Reply:* Never used this attribute but I think it should work. I always use the attribute MSExchHomeServerName. If it equals to the on-prem server the mailbox is not migrated yet.
*Thread Reply:* That should not be possible, if you removed the MDM profile manually or performed a Retire command. Are these ABM devices?
*Thread Reply:* Our Core is offline because of a security incident, so no retire from Core possible. Yes some of these devices are ABM.
*Thread Reply:* What error do you get when Intune tries to implement its MDM profile?
*Thread Reply:* “This device is registered with MobileIron Device Compliance On-prem.”
*Thread Reply:* Oh wait just a minute - this is the partner compliance
*Thread Reply:* Of course - we have registered most of the devices in Azure with the Core Partner Compliance. So we have to remove the devices from Azure I guess.
*Thread Reply:* Intune is also registered with ABM now? If your moving around the ABM profile needs to be intune as well
*Thread Reply:* You mean the database on Core? If we remove the profile manually on the device and uninstall the Ivanti app, how would a connection to Core be relevant?
Okay -- Admittedly it's been a minute since I've enrolled an AE Work Managed Device (No Work Profile) into MI Cloud/Neurons MDM. Is there something more I need to do in order for the profile to install? Device gets through the Provisioner/QR/6x Tap startup wizard and then just sits there waiting for the profile. Have tested in 2x Ivanti tenants and am receiving the same result.
*Thread Reply:* You need to assign the Android WPCoD configuration, not the Work Managed one
*Thread Reply:* On it. Give me a few and I'll report back.
*Thread Reply:* For Rugged Devices (Honeywell/Zebra) is that applied to the Neurons/local "Service Account" that is created for those type devices?
*Thread Reply:* @Woody did you use user groups?
*Thread Reply:* @Florent N. I can. Presently just assigned directly to my test user
*Thread Reply:* I did not understand your question sorry.
*Thread Reply:* Sorry, it revolves around the use of Honeywell/Zebra scanner devices
*Thread Reply:* Will they also need to have the Android WPCoD assigned?
*Thread Reply:* Obviously going to follow the vendor's documentation/specifications, but at its core they should follow the same approach. Right?
*Thread Reply:* Only if you want work profile on them, if not use the other ae configuration
*Thread Reply:* Work Profile (on a dedicated device) will just be the single profile... with no Work Satchel. Right?
*Thread Reply:* I've tried all the other configs and they result in the same screen-shot I sent at the beginning of this thread
*Thread Reply:* Or is that the stance going forward? That a Work Profile will be on the CoD irregardless
*Thread Reply:* Are you using gms versions of Zebra OSs ?
*Thread Reply:* I'm currently testing on Samsung Hardware. The customer will be responsible for the Zebra side of the house, I'm just mentally prepping so I can educate him
*Thread Reply:* Work Profile is for BYOD
*Thread Reply:* So if I'm doing Company Owned/Dedicated Device... I should be using: Android enterprise: Work Managed Device (Android for Work)
*Thread Reply:* Yes if you don't want a work profile on them
*Thread Reply:* @Florent N. is it possible to install the Android enterprise: Work Managed Device (Android for Work) profile by using the 6x taps? Or does it need to come through ZTE/KME to have that flag set?
*Thread Reply:* It appears to still be a Android Work Managed Device, but I can't get that profile to push.
*Thread Reply:* Interesting. I got it to install, but had to reboot the device first
*Thread Reply:* It can take time sometimes
*Thread Reply:* Okay, closure here. There's something up with Android 9 phones and the 6x Tap (QR code from Ivanti Provisioner) into Device Owner/CoD mode. They come through fine with KNOX KME, but don't provision properly using the taps. I tried the 6x tap with my S8 Tablet (Android 14) and it came right through. Guess it's about time to finally retire the old fleet of Android 9 units.
*Thread Reply:* @Florent N. Even more closure: The phone I was testing with (I have two identical A10e units) isn’t registering its AE attributes correctly with Ivanti, therefore it isn’t added to the Android Enterprise group (and isn’t entitled to the profiles). I tested several times with my S8 Tablet and achieved success every time. Definitely time to retire these older units.
*Thread Reply:* @Mikey2000 it hasnt really changed in a while it seems, especially as they are now pushing Lookout as the replacement to Ivanti MTD https://help.ivanti.com/mi/help/en_us/mtd/11.x/gdco/Content/LandingPage.htm
*Thread Reply:* Oooh that's an extremely spicy question for Ivanti these days hahahah
*Thread Reply:* We had that issue before and it was supposedly a known one that was worked out a while back. I think a year ago.
Haven't heard about it popping up again though. https://forums.ivanti.com/s/article/Email-and-gmail-randomly-fail-to-sync-on-Android-OS-13-devices?language=en_US
*Thread Reply:* Almost 100% of Zebra devices I deploy and manage have a custom lockdown applied from the MDM and therefore the base wallpaper is never displayed to the end user. Are these devices not locked down?
*Thread Reply:* Also curious and a bit confused by what you mean by AOSP mode. All Zebra devices that have shipped since basically the WT6000 and TC8000 have been GMS with the exception of China based AOSP skus
*Thread Reply:* OEMConfig itself is an Android Enterprise feature typically deployed through Managed Play. If your devices are AOSP then OEMConfig may not be an option unless you EMM can handle “offline” managed configurations
*Thread Reply:* On AOSP Mode on EPMM/Core you can use OEMConfig apps as well.
You just need to upload OEMConfig app as in-house, and you will see Managed Config inside.
The limitation is that same server won’t be able to deploy in-house (for AOSP) and public (for any other AE mode) version of same app, so if you are using same EPMM server, you just can do one or the other.
Now, On EPMM you can still push XML configs from StageNow to Zebra devices, regardless if they are AOSP or regular AE.
If StageNow meets your needs, I’d go this way instead of thru OEMConfig.
Hope it can help,
*Thread Reply:* I used Android devices usings AOSP/closed network. I need to change the wallpaper and lockscreen wallpaper. My config os never push and I have to trigger oem config change intent using adb but my config is never pushed. However, other app received the configuration.
*Thread Reply:* When you say your config, which one do you mean?.
A XML you created on StageNow and uploaded to EPMM, then pushed to AOSP devices?
A Wallpaper config for DO mode created on EPMM and pushed to devices?.
A configuration created within in-house Zebra OEMConfig app and sent to AOSP devices?.
Which one?
*Thread Reply:* If EPMM native wallpaper config is not working, I’d try creating XML on SN and pushing it to devices.
*Thread Reply:* If you only have AOSP devices managed on this EPMM server, you can try uploading OEMConfig app as in-house, and remember to upload any app update manually, but if you also manage regular AE devices, better going with XML way
*Thread Reply:* I mean Zebra OEM config managed config (no status in app)
*Thread Reply:* I wanted to try using oeam config to use file transfer instead of remote server as variable cannot be used in xml config
*Thread Reply:* Umm, weird that it’s not being pushed.
*Thread Reply:* Yeah, I had to trigger config change using adb to see a last update timestamp in app but still no status
*Thread Reply:* I tested this on Samsung and worked but I have no Zebra devices to test
*Thread Reply:* Wallpaper config is not applied at all (not visible)
*Thread Reply:* Got it.
You should open a support ticket then as I’ve mentioned, same in-house OEMConfig approach worked with other vendors on AOSP mode.
*Thread Reply:* Thanks for your help, I will do it then.
*Thread Reply:* Try with a Samsung device to compare, or any other one you may have that also has OEMConfig app. Registered as AOSP for sure.
*Thread Reply:* I will try on Samsung and see if it works. And maybe with legacy Zebra OEM config
*Thread Reply:* Guessing there was a Russian developer involved in the app at some point.
*Thread Reply:* It's funny to see dev history in some little things, there is something similar with One Drive app
